Opened 9 years ago

Last modified 7 years ago

#9493 new Bugs

labeled_graph may refer to and operate on released memory after removing a vertex by label

Reported by: Adam Romanek <romanek.adam@…> Owned by: Jeremiah Willcock
Milestone: To Be Determined Component: graph
Version: Boost 1.54.0 Severity: Problem
Keywords: Cc:

Description

Although labeled_graph is not officially part of BGL API some people try to use it.

Unfortunately, the current implementation has a serious bug that might lead to a crash. The problem appears when removing a vertex from labeled_graph by its label. My investigation shown that despite of vertex being actually removed, the label is not and it still refers to the removed vertex.

The problem is "easier" to reproduce when adjacency_list's VertexList is set to a container like boost::listS.

The attached test case shows the problem. I also attached the output from a valgrind run on the test case code and a patch that fixes the issue for the "configuration" that I use (a more generic fix will probably be needed).

Attachments (3)

test.cpp (508 bytes ) - added by Adam Romanek <romanek.adam@…> 9 years ago.
valgrind.txt (5.8 KB ) - added by Adam Romanek <romanek.adam@…> 9 years ago.
boost_labeled_graph_fix.patch (1.1 KB ) - added by Adam Romanek <romanek.adam@…> 9 years ago.

Download all attachments as: .zip

Change History (5)

by Adam Romanek <romanek.adam@…>, 9 years ago

Attachment: test.cpp added

by Adam Romanek <romanek.adam@…>, 9 years ago

Attachment: valgrind.txt added

by Adam Romanek <romanek.adam@…>, 9 years ago

in reply to:  description comment:1 by fawques@…, 9 years ago

Having this issue, the patch worked like a charm. Thanks

Replying to Adam Romanek <romanek.adam@…>:

Although labeled_graph is not officially part of BGL API some people try to use it.

Unfortunately, the current implementation has a serious bug that might lead to a crash. The problem appears when removing a vertex from labeled_graph by its label. My investigation shown that despite of vertex being actually removed, the label is not and it still refers to the removed vertex.

The problem is "easier" to reproduce when adjacency_list's VertexList is set to a container like boost::listS.

The attached test case shows the problem. I also attached the output from a valgrind run on the test case code and a patch that fixes the issue for the "configuration" that I use (a more generic fix will probably be needed).

comment:2 by boost@…, 7 years ago

This bug is still present in 1.59.0. I would greatly appreciate if the patch finds its way into the next release.

Note: See TracTickets for help on using tickets.