[med-svn] [Git][med-team/terraphast][master] 2 commits: Fix heap corruption when the multitree memory limit is reached (Closes: #1139550)
Andreas Tille (@tille)
gitlab at salsa.debian.org
Sat Oct 17 18:16:17 BST 2026
Andreas Tille pushed to branch master at Debian Med / terraphast
Commits:
ed32ca4d by Andreas Tille at 2026-10-17T19:14:48+02:00
Fix heap corruption when the multitree memory limit is reached (Closes: #1139550)
When the multitree memory limit is hit, begin_iteration() returns an
unexplored node because the alternative array could not be allocated, but
continue_iteration() still returned true (the memory accounting was below
the limit). The iteration loop then called accumulate() on the unexplored
node, writing a full multitree_node (including a GMP big_integer) into the
leaf array of the unexplored node. This corrupted the heap and could
abort with a 'realloc(): invalid pointer' inside GMP, making the unittests
fail randomly (FTBFS).
Mark the memory limit as hit whenever begin_iteration() has to fall back
to an unexplored node so that continue_iteration() stops the iteration.
- - - - -
39c9c4ba by Andreas Tille at 2026-10-17T19:15:52+02:00
c-api: fix out-of-bounds write in the c_api_error_num_partitions test (assisted by inference.debian.net DeepSeek V4 model)
* c-api: fix out-of-bounds write in the c_api_error_num_partitions test
* site_gen: fix root species off-by-one that could generate data with
sites lacking any occurrence, aborting validated_run
* debian/tests: fix run-unit-test autopkgtest; generate test data with
the installed tools instead of referencing non-installed examples
- - - - -
4 changed files:
- debian/changelog
- + debian/patches/fix-memory-limit-corruption.patch
- debian/patches/series
- debian/tests/run-unit-test
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,15 @@
+terraphast (0.1.0+dfsg-2) UNRELEASED; urgency=medium
+
+ * Fix heap corruption when the multitree memory limit is reached
+ (Closes: #1139550)
+ * c-api: fix out-of-bounds write in the c_api_error_num_partitions test
+ * site_gen: fix root species off-by-one that could generate data with
+ sites lacking any occurrence, aborting validated_run
+ * debian/tests: fix run-unit-test autopkgtest; generate test data with
+ the installed tools instead of referencing non-installed examples
+
+ -- Andreas Tille <tille at debian.org> Sat, 17 Oct 2026 00:00:00 +0200
+
terraphast (0.1.0+dfsg-1) unstable; urgency=medium
* Fix build with CMake 4
=====================================
debian/patches/fix-memory-limit-corruption.patch
=====================================
@@ -0,0 +1,40 @@
+Description: Fix heap corruption when the multitree memory limit is reached
+ In the memory limited multitree callback, begin_iteration() returns an
+ "unexplored" node when the alternative array cannot be allocated (e.g.
+ because the memory limit was reached). The loop in
+ tree_enumerator::iterate() then kept iterating over the bipartitions and
+ called accumulate() on that unexplored node as if it were an alternative
+ array, writing a full multitree_node into the leaf array of the unexplored
+ node. This corrupted the heap and could lead to a "realloc(): invalid
+ pointer" abort inside GMP, making the unittests fail randomly.
+ .
+ Fix this by marking the memory limit as hit whenever begin_iteration()
+ has to fall back to an unexplored node, so that continue_iteration()
+ stops the iteration and accumulate() is never called on an unexplored
+ node.
+Author: Andreas Tille <tille at debian.org>
+Forwarded: https://github.com/amkozlov/terraphast-one
+Last-Update: 2026-10-17
+
+--- terraphast-0.1.0+dfsg.orig/lib/supertree_variants_multitree.hpp
++++ terraphast-0.1.0+dfsg/lib/supertree_variants_multitree.hpp
+@@ -99,6 +99,19 @@ public:
+ set_node_memory_limit(limit);
+ }
+
++ return_type begin_iteration(const bipartitions& bip_it, const bitvector& c_occ,
++ const constraints& c) {
++ auto result = multitree_callback::begin_iteration(bip_it, c_occ, c);
++ if (result->type == multitree_node_type::unexplored) {
++ // The alternative array for this node could not be allocated
++ // (usually because the memory limit was reached). In this case
++ // we must not iterate over the bipartitions below this node,
++ // so mark the memory limit as hit to stop further iteration.
++ m_hit_memory_limit = true;
++ }
++ return result;
++ }
++
+ bool fast_return(const bipartitions& bip_it) {
+ return multitree_callback::fast_return(bip_it) || check_memory_limit();
+ }
=====================================
debian/patches/series
=====================================
@@ -1 +1,4 @@
dynamic_lib.patch
+fix-memory-limit-corruption.patch
+fix-c-api-test-corruption.patch
+site-gen-root-species.patch
=====================================
debian/tests/run-unit-test
=====================================
@@ -1,21 +1,23 @@
#!/bin/sh
+set -e
+
pkg=terraphast
if [ "$AUTOPKGTEST_TMP" = "" ]; then
AUTOPKGTEST_TMP=`mktemp -d /tmp/${pkg}-test.XXXX`
- trap "rm -rf $AUTOPKG_TMP" 0 INT QUIT ABRT PIPE TERM
+ trap "rm -rf $AUTOPKGTEST_TMP" 0 INT QUIT ABRT PIPE TERM
fi
-cd $AUTOPKGTEST_TMP
+cd "$AUTOPKGTEST_TMP"
-# Get data
-cp -a /usr/share/doc/${pkg}/examples/* .
+# Generate a random tree and matching occurrence data
+/usr/lib/terraphast/tree_gen 6 > tree.nwk
+/usr/lib/terraphast/site_gen 6 8 0.2 > data.txt
# Enumerate terraces in phylogenetic tree space
-terraphast Meusemann.nwk Meusemann.data
+/usr/lib/terraphast/validated_run count tree.nwk data.txt > /dev/null
-# Remove data
-rm Meusemann.*
+echo "test passed"
View it on GitLab: https://salsa.debian.org/med-team/terraphast/-/compare/e4ac47062488f76c90341bd1749e137fbaf81047...39c9c4bac01854e6de091e91b87b354367b44030
--
View it on GitLab: https://salsa.debian.org/med-team/terraphast/-/compare/e4ac47062488f76c90341bd1749e137fbaf81047...39c9c4bac01854e6de091e91b87b354367b44030
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-med-commit/attachments/20261017/e5469510/attachment-0001.htm>
More information about the debian-med-commit
mailing list