Re: [ISSUE] [CLOSED] flightgear: abort with free() invalid size

[rien <rien@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 4741 bytes --]

Closed issue by rien on void-packages repository

https://github.com/void-linux/void-packages/issues/24873

Description:
<!-- Don't request update of package. We have a script for that. https://alpha.de.repo.voidlinux.org/void-updates/void-updates.txt . However, a quality pull request may help. -->
### System

* xuname: Void 5.8.8_1 x86_64 GenuineIntel uptodate rrrrmdFFFFFFFFFFF
  *output of ``xuname`` (part of xtools)*
* package: flighgear-2020.1.3_1
  *affected package(s) including the version*: ``xbps-query -p pkgver <pkgname>``

### Expected behavior

The program launches when running `fgfs`.

### Actual behavior

The program aborts with exit code 1.

```
#  fgfs
free(): invalid size
Aborted
```

When running `fgfs` in gdb I have the following backtrace (`bt`):
```
>>> bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff3e5255b in __GI_abort () at abort.c:79
#2  0x00007ffff3eaadf8 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff3fb6f3e "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff3eb216a in malloc_printerr (str=str@entry=0x7ffff3fb50f8 "free(): invalid size") at malloc.c:5332
#4  0x00007ffff3eb3b4c in _int_free (av=<optimized out>, p=0x7ffff7b67de0 <vtable for osgDB::Registry>, have_lock=0) at malloc.c:4177
#5  0x0000555555f964cd in __gnu_cxx::new_allocator<char>::deallocate (this=0x555556d97cc0, __p=<optimized out>) at /usr/include/c++/9.3/ext/new_allocator.h:119
#6  std::allocator_traits<std::allocator<char> >::deallocate (__a=..., __n=<optimized out>, __p=<optimized out>) at /usr/include/c++/9.3/bits/alloc_traits.h:470
#7  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_destroy (__size=<optimized out>, this=0x555556d97cc0) at /usr/include/c++/9.3/bits/basic_string.h:237
#8  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_dispose (this=0x555556d97cc0) at /usr/include/c++/9.3/bits/basic_string.h:232
#9  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string (this=0x555556d97cc0, __in_chrg=<optimized out>) at /usr/include/c++/9.3/bits/basic_string.h:658
#10 std::_Destroy<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > (__pointer=0x555556d97cc0) at /usr/include/c++/9.3/bits/stl_construct.h:98
#11 std::_Destroy_aux<false>::__destroy<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*> (__last=<optimized out>, __first=0x555556d97cc0) at /usr/include/c++/9.3/bits/stl_construct.h:108
#12 std::_Destroy<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*> (__last=<optimized out>, __first=<optimized out>) at /usr/include/c++/9.3/bits/stl_construct.h:137
#13 std::_Destroy<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > (__last=0x7fffffffe050, __first=<optimized out>) at /usr/include/c++/9.3/bits/stl_construct.h:206
#14 std::deque<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::_M_destroy_data_aux (this=<optimized out>, __first=..., __last=...) at /usr/include/c++/9.3/bits/deque.tcc:864
#15 0x00007ffff7b17e9d in osgDB::Registry::initDataFilePathList() () from /usr/lib/libosgDB.so.131
#16 0x00007ffff7b18403 in osgDB::Registry::Registry() () from /usr/lib/libosgDB.so.131
#17 0x00007ffff7b19cdd in osgDB::Registry::instance(bool) () from /usr/lib/libosgDB.so.131
#18 0x00007ffff7a89009 in osgDB::RegisterCompressorProxy::RegisterCompressorProxy(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, osgDB::BaseCompressor*) () from /usr/lib/libosgDB.so.131
#19 0x00007ffff7a83c81 in ?? () from /usr/lib/libosgDB.so.131
#20 0x00007ffff7fe31ea in call_init (l=<optimized out>, argc=argc@entry=1, argv=argv@entry=0x7fffffffe2e8, env=env@entry=0x7fffffffe2f8) at dl-init.c:72
#21 0x00007ffff7fe32e9 in call_init (env=0x7fffffffe2f8, argv=0x7fffffffe2e8, argc=1, l=<optimized out>) at dl-init.c:30
#22 _dl_init (main_map=0x7ffff7ffe130, argc=1, argv=0x7fffffffe2e8, env=0x7fffffffe2f8) at dl-init.c:119
#23 0x00007ffff7fd50ca in _dl_start_user () from /lib/ld-linux-x86-64.so.2
#24 0x0000000000000001 in ?? ()
#25 0x00007fffffffe633 in ?? ()
#26 0x0000000000000000 in ?? ()
```

So the invalid free seems to originate in libosgDB...

### Steps to reproduce the behavior

Start the program.

Extra information about my setup: I'm running this in X11 in a custom `dwm` fork.