Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-97627

heap-use-after-free when running ninja html_docs in qtbase

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P1: Critical
    • 6.2.3, 6.3.0 Alpha
    • 6.3
    • Build tools: qdoc
    • None
    • Ubuntu 20.04.2
    • 5
    • 02057fc029e3d2cc1808fe712fca84ccfc074f99 (qt/qttools/dev) 40785d2b4107b7f86e9464f4696189c30cf5f740 (qt/qttools/6.2)
    • Da Vinci sprint 43

    Description

      I'm trying to build the documentation to test out https://codereview.qt-project.org/c/qt/qtbase/+/375915 but run into an issue:

      mitch@mitch-ubuntu-20:~/dev/qt-dev-debug/qtbase$ ninja html_docs
      [13/36] cd /home/mitch/dev/qt-dev-debug/qtbase/qmake && /home/mitch/dev/cmake-build/bin/cmake -E env...-debug/qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/qmake/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QMake in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QMake"
      qt.qdoc: Source files parsed for "QMake"
      qt.qdoc: End qdoc for QMake in dual process mode: prepare phase.
      [14/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/xml && /home/mitch/dev/cmake-build/bin/cmake -E e...ebug/qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/xml/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtXml in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtXml"
      qt.qdoc: Source files parsed for "QtXml"
      qt.qdoc: End qdoc for QtXml in dual process mode: prepare phase.
      [15/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/concurrent && /home/mitch/dev/cmake-build/bin/cma...base/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/concurrent/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtConcurrent in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtConcurrent"
      qt.qdoc: Source files parsed for "QtConcurrent"
      qt.qdoc: End qdoc for QtConcurrent in dual process mode: prepare phase.
      [16/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/sql && /home/mitch/dev/cmake-build/bin/cmake -E e...ebug/qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/sql/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtSql in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtSql"
      qt.qdoc: Source files parsed for "QtSql"
      qt.qdoc: End qdoc for QtSql in dual process mode: prepare phase.
      [17/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/testlib && /home/mitch/dev/cmake-build/bin/cmake .../qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/testlib/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtTestLib in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtTestLib"
      qt.qdoc: Source files parsed for "QtTestLib"
      qt.qdoc: End qdoc for QtTestLib in dual process mode: prepare phase.
      [18/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/dbus && /home/mitch/dev/cmake-build/bin/cmake -E ...bug/qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/dbus/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtDBus in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtDBus"
      qt.qdoc: Source files parsed for "QtDBus"
      qt.qdoc: End qdoc for QtDBus in dual process mode: prepare phase.
      [19/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/opengl && /home/mitch/dev/cmake-build/bin/cmake -...g/qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/opengl/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtOpenGL in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtOpenGL"
      qt.qdoc: Source files parsed for "QtOpenGL"
      qt.qdoc: End qdoc for QtOpenGL in dual process mode: prepare phase.
      [20/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/printsupport && /home/mitch/dev/cmake-build/bin/c...se/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/printsupport/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtPrintSupport in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtPrintSupport"
      qt.qdoc: Source files parsed for "QtPrintSupport"
      qt.qdoc: End qdoc for QtPrintSupport in dual process mode: prepare phase.
      [21/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/network && /home/mitch/dev/cmake-build/bin/cmake .../qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/network/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtNetwork in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtNetwork"
      qt.qdoc: Source files parsed for "QtNetwork"
      qt.qdoc: End qdoc for QtNetwork in dual process mode: prepare phase.
      [22/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/gui && /home/mitch/dev/cmake-build/bin/cmake -E e...ebug/qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/gui/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtGui in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtGui"
      qt.qdoc: Source files parsed for "QtGui"
      qt.qdoc: End qdoc for QtGui in dual process mode: prepare phase.
      [23/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/corelib && /home/mitch/dev/cmake-build/bin/cmake .../qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/corelib/.doc/Debug/includes.txt
      FAILED: src/corelib/CMakeFiles/prepare_docs_Core /home/mitch/dev/qt-dev-debug/qtbase/src/corelib/CMakeFiles/prepare_docs_Core 
      cd /home/mitch/dev/qt-dev-debug/qtbase/src/corelib && /home/mitch/dev/cmake-build/bin/cmake -E env QT_INSTALL_DOCS="/home/mitch/dev/qt-dev-debug/qtbase/doc" QT_VERSION=6.3.0 QT_VER=6.3 QT_VERSION_TAG=630 BUILDDIR=/home/mitch/dev/qt-dev-debug/qtbase/src/corelib /home/mitch/dev/qt-dev-debug/qtbase/bin/qdoc -installdir /home/mitch/dev/qt-dev-debug/qtbase/doc -outputdir /home/mitch/dev/qt-dev-debug/qtbase/doc/qtcore /home/mitch/dev/qt-dev/qtbase/src/corelib/doc/qtcore.qdocconf -prepare -indexdir /home/mitch/dev/qt-dev-debug/qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/corelib/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtCore in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtCore"
      qt.qdoc: Source files parsed for "QtCore"
      qt.qdoc: End qdoc for QtCore in dual process mode: prepare phase.
      =================================================================
      ==30278==ERROR: AddressSanitizer: heap-use-after-free on address 0x616000aec090 at pc 0x55e69d875bcd bp 0x7ffcd06bb220 sp 0x7ffcd06bb210
      READ of size 8 at 0x616000aec090 thread T0
          #0 0x55e69d875bcc in Node::parent() const /home/mitch/dev/qt-dev/qttools/src/qdoc/node.h:294
          #1 0x55e69dc5e7d2 in NamespaceNode::~NamespaceNode() /home/mitch/dev/qt-dev/qttools/src/qdoc/namespacenode.cpp:63
          #2 0x55e69dc5e90b in NamespaceNode::~NamespaceNode() /home/mitch/dev/qt-dev/qttools/src/qdoc/namespacenode.cpp:66
          #3 0x55e69d86a0a4 in Aggregate::~Aggregate() /home/mitch/dev/qt-dev/qttools/src/qdoc/aggregate.cpp:82
          #4 0x55e69dc5e881 in NamespaceNode::~NamespaceNode() /home/mitch/dev/qt-dev/qttools/src/qdoc/namespacenode.cpp:60
          #5 0x55e69dd76532 in Tree::~Tree() /home/mitch/dev/qt-dev/qttools/src/qdoc/tree.cpp:96
          #6 0x55e69dc8a622 in QDocForest::~QDocForest() /home/mitch/dev/qt-dev/qttools/src/qdoc/qdocdatabase.cpp:91
          #7 0x55e69dca18c3 in QDocDatabase::~QDocDatabase() /home/mitch/dev/qt-dev/qttools/src/qdoc/qdocdatabase.h:205
          #8 0x55e69dc8c5e2 in QDocDatabase::destroyQdocDB() /home/mitch/dev/qt-dev/qttools/src/qdoc/qdocdatabase.cpp:405
          #9 0x55e69dc321d6 in main /home/mitch/dev/qt-dev/qttools/src/qdoc/main.cpp:615
          #10 0x7fcaca6530b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
          #11 0x55e69d869d3d in _start (/home/mitch/dev/qt-dev-debug/qtbase/bin/qdoc+0x9fd3d)
      
      0x616000aec090 is located 16 bytes inside of 560-byte region [0x616000aec080,0x616000aec2b0)
      freed by thread T0 here:
          #0 0x7fcad08bb025 in operator delete(void*, unsigned long) (/lib/x86_64-linux-gnu/libasan.so.5+0x111025)
          #1 0x55e69db0b8c6 in FunctionNode::~FunctionNode() /home/mitch/dev/qt-dev/qttools/src/qdoc/functionnode.h:41
          #2 0x55e69d86a0a4 in Aggregate::~Aggregate() /home/mitch/dev/qt-dev/qttools/src/qdoc/aggregate.cpp:82
          #3 0x55e69d91b57c in ClassNode::~ClassNode() (/home/mitch/dev/qt-dev-debug/qtbase/bin/qdoc+0x15157c)
          #4 0x55e69d91b59b in ClassNode::~ClassNode() (/home/mitch/dev/qt-dev-debug/qtbase/bin/qdoc+0x15159b)
          #5 0x55e69d86a0a4 in Aggregate::~Aggregate() /home/mitch/dev/qt-dev/qttools/src/qdoc/aggregate.cpp:82
          #6 0x55e69dc5e881 in NamespaceNode::~NamespaceNode() /home/mitch/dev/qt-dev/qttools/src/qdoc/namespacenode.cpp:60
          #7 0x55e69dd76532 in Tree::~Tree() /home/mitch/dev/qt-dev/qttools/src/qdoc/tree.cpp:96
          #8 0x55e69dc8a622 in QDocForest::~QDocForest() /home/mitch/dev/qt-dev/qttools/src/qdoc/qdocdatabase.cpp:91
          #9 0x55e69dca18c3 in QDocDatabase::~QDocDatabase() /home/mitch/dev/qt-dev/qttools/src/qdoc/qdocdatabase.h:205
          #10 0x55e69dc8c5e2 in QDocDatabase::destroyQdocDB() /home/mitch/dev/qt-dev/qttools/src/qdoc/qdocdatabase.cpp:405
          #11 0x55e69dc321d6 in main /home/mitch/dev/qt-dev/qttools/src/qdoc/main.cpp:615
          #12 0x7fcaca6530b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
      
      previously allocated by thread T0 here:
          #0 0x7fcad08b9947 in operator new(unsigned long) (/lib/x86_64-linux-gnu/libasan.so.5+0x10f947)
          #1 0x55e69d8b59ae in ClangVisitor::visitHeader(CXCursor, CXSourceLocation) /home/mitch/dev/qt-dev/qttools/src/qdoc/clangcodeparser.cpp:723
          #2 0x55e69d8d64cf in ClangVisitor::visitChildren(CXCursor)::{lambda(CXCursor)#1}::operator()(CXCursor) const /home/mitch/dev/qt-dev/qttools/src/qdoc/clangcodeparser.cpp:428
          #3 0x55e69d8db22a in visitChildrenLambda<ClangVisitor::visitChildren(CXCursor)::{lambda(CXCursor)#1}>(CXCursor, ClangVisitor::visitChildren(CXCursor)::{lambda(CXCursor)#1}&&)::{lambda(CXCursor, CXCursor, void*)#1}::operator()(CXCursor, CXCursor, ClangVisitor::visitChildren(CXCursor)::{lambda(CXCursor)#1}&&) const /home/mitch/dev/qt-dev/qttools/src/qdoc/clangcodeparser.cpp:106
          #4 0x55e69d8db2d5 in visitChildrenLambda<ClangVisitor::visitChildren(CXCursor)::{lambda(CXCursor)#1}>(CXCursor, ClangVisitor::visitChildren(CXCursor)::{lambda(CXCursor)#1}&&)::{lambda(CXCursor, CXCursor, void*)#1}::_FUN(CXCursor, CXCursor, ClangVisitor::visitChildren(CXCursor)::{lambda(CXCursor)#1}&&) /home/mitch/dev/qt-dev/qttools/src/qdoc/clangcodeparser.cpp:104
          #5 0x7fcacd9a462d  (/home/mitch/dev/libclang-release_110-based-linux-Ubuntu20.04-gcc9.3-x86_64/libclang/lib/libclang.so.11+0x56c62d)
      
      SUMMARY: AddressSanitizer: heap-use-after-free /home/mitch/dev/qt-dev/qttools/src/qdoc/node.h:294 in Node::parent() const
      Shadow bytes around the buggy address:
        0x0c2c801557c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2c801557d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2c801557e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2c801557f0: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
        0x0c2c80155800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      =>0x0c2c80155810: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2c80155820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2c80155830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2c80155840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2c80155850: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
        0x0c2c80155860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==30278==ABORTING
      [24/36] cd /home/mitch/dev/qt-dev-debug/qtbase/src/widgets && /home/mitch/dev/cmake-build/bin/cmake .../qtbase/doc -no-link-errors @/home/mitch/dev/qt-dev-debug/qtbase/src/widgets/.doc/Debug/includes.txt
      qt.qdoc: Start qdoc for QtWidgets in dual process mode: prepare phase.
      qt.qdoc: Parse source files for "QtWidgets"
      qt.qdoc: Source files parsed for "QtWidgets"
      qt.qdoc: End qdoc for QtWidgets in dual process mode: prepare phase.
      ninja: build stopped: subcommand failed.
      

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            treinio Topi Reiniƶ
            mitch_curtis Mitch Curtis
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes