Bug#820591: libgmp-dev: realloc() with invalid pointer

[Michele Orru`]

Package: libgmp-dev
Version: 2:6.1.0+dfsg-2
Severity: normal
Tags: upstream

Dear Maintainer,

Given the following code:

8<--------

#include <gmp.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
  if (argc <  2) {
    return EXIT_FAILURE;
  }

  mpz_t key[argc-1];

  for (int j = 0; j < argc-1; ++j) {
    mpz_set_str(key[j], argv[j], 2);
  }
  return EXIT_SUCCESS;
}

---->8

and compiling it with

$ cc -o foo foo.c -lgmp

(I tried both clang and gcc) I get the following errors:

[maker at tumbolandia src]$ ./foo  1 2 3 4 5 6
foo: malloc.c:2862: mremap_chunk: Assertion `((size + offset) &
(_rtld_global_ro._dl_pagesize - 1)) == 0' failed.
Aborted
134 · [maker at tumbolandia src]$ ./foo  1 2 3 4 5 6  7
Segmentation fault
139 · [maker at tumbolandia src]$ ./foo  1 2 3 4 5 6  7 8
*** Error in `./foo': realloc(): invalid pointer: 0x0000000000400444 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x71ff5)[0x7feb16ff8ff5]
/lib/x86_64-linux-gnu/libc.so.6(+0x77946)[0x7feb16ffe946]
/lib/x86_64-linux-gnu/libc.so.6(realloc+0x1db)[0x7feb17002cab]
/lib/x86_64-linux-gnu/libgmp.so.10(__gmp_default_reallocate+0x14)[0x7feb17337944]
/lib/x86_64-linux-gnu/libgmp.so.10(__gmpz_realloc+0x3a)[0x7feb1734e55a]
/lib/x86_64-linux-gnu/libgmp.so.10(__gmpz_set_str+0x2d8)[0x7feb1734f918]
./foo[0x400726]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7feb16fa7610]
./foo[0x400589]
======= Memory map: ========
00400000-00401000 r-xp 00000000 fe:03 3937778
/home/maker/dev/timing/src/foo
00600000-00601000 rw-p 00000000 fe:03 3937778
/home/maker/dev/timing/src/foo
0098a000-009ab000 rw-p 00000000 00:00 0                                  [heap]
7feb16d71000-7feb16d87000 r-xp 00000000 fe:01 263955
/usr/lib/x86_64-linux-gnu/libgcc_s.so.1
7feb16d87000-7feb16f86000 ---p 00016000 fe:01 263955
/usr/lib/x86_64-linux-gnu/libgcc_s.so.1
7feb16f86000-7feb16f87000 rw-p 00015000 fe:01 263955
/usr/lib/x86_64-linux-gnu/libgcc_s.so.1
7feb16f87000-7feb17121000 r-xp 00000000 fe:01 331212
/usr/lib/x86_64-linux-gnu/libc-2.22.so
7feb17121000-7feb17321000 ---p 0019a000 fe:01 331212
/usr/lib/x86_64-linux-gnu/libc-2.22.so
7feb17321000-7feb17325000 r--p 0019a000 fe:01 331212
/usr/lib/x86_64-linux-gnu/libc-2.22.so
7feb17325000-7feb17327000 rw-p 0019e000 fe:01 331212
/usr/lib/x86_64-linux-gnu/libc-2.22.so
7feb17327000-7feb1732b000 rw-p 00000000 00:00 0
7feb1732b000-7feb173ad000 r-xp 00000000 fe:01 265195
/usr/lib/x86_64-linux-gnu/libgmp.so.10.3.0
7feb173ad000-7feb175ac000 ---p 00082000 fe:01 265195
/usr/lib/x86_64-linux-gnu/libgmp.so.10.3.0
7feb175ac000-7feb175ad000 r--p 00081000 fe:01 265195
/usr/lib/x86_64-linux-gnu/libgmp.so.10.3.0
7feb175ad000-7feb175ae000 rw-p 00082000 fe:01 265195
/usr/lib/x86_64-linux-gnu/libgmp.so.10.3.0
7feb175ae000-7feb175d0000 r-xp 00000000 fe:01 331209
/usr/lib/x86_64-linux-gnu/ld-2.22.so
7feb1779c000-7feb1779f000 rw-p 00000000 00:00 0
7feb177cc000-7feb177cf000 rw-p 00000000 00:00 0
7feb177cf000-7feb177d0000 r--p 00021000 fe:01 331209
/usr/lib/x86_64-linux-gnu/ld-2.22.so
7feb177d0000-7feb177d1000 rw-p 00022000 fe:01 331209
/usr/lib/x86_64-linux-gnu/ld-2.22.so
7feb177d1000-7feb177d2000 rw-p 00000000 00:00 0
7ffcfb3a1000-7ffcfb3c2000 rw-p 00000000 00:00 0                          [stack]
7ffcfb3ee000-7ffcfb3f0000 r--p 00000000 00:00 0                          [vvar]
7ffcfb3f0000-7ffcfb3f2000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
[vsyscall]
Aborted

I have *no* idea about why this is happening. Any clue?


-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (900, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.4.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages libgmp-dev depends on:
ii  libgmp10       2:6.1.0+dfsg-2
ii  libgmpxx4ldbl  2:6.1.0+dfsg-2

libgmp-dev recommends no packages.

Versions of packages libgmp-dev suggests:
ii  gmp-doc       6.0.0-1
ii  libgmp10-doc  2:6.1.0+dfsg-2
ii  libmpfr-dev   3.1.4-1

-- no debconf information