search

vlm / asn1c

The ASN.1 Compiler
http://lionet.info/asn1c/
BSD 2-Clause "Simplified" License
1.03k stars 551 forks source link

Memory leakage issues in all SAE J2735 message will decoding #279

Open Purnanandj opened 6 years ago

Purnanandj commented 6 years ago

Hi ,

During the check of Heap memory using valgrind for map data decoding using uper_decode() there was some 264 bytes of leakage as the CALLOC memory was not freed.

Have also addressed the same issue with BSM and EVA message.

Please find the below valgrind report.

==5215== Memcheck, a memory error detector ==5215== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==5215== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info ==5215== Command: ./my-program ==5215== Parent PID: 2379 ==5215== ==5215== Invalid read of size 4 ==5215== at 0x80520C0: populate_sae_to_map (BSM_SAE_conversions.c:409) ==5215== by 0x8052336: Decode_SAE_MAP (BSM_SAE_conversions.c:604) ==5215== by 0x80610B9: main (converter-sample.c:114) ==5215== Address 0x41fe388 is 0 bytes inside a block of size 4 free'd ==5215== at 0x402B3D8: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5215== by 0x806D32C: NativeEnumerated_decode_uper (NativeEnumerated.c:146) ==5215== by 0x80599DE: SEQUENCE_decode_uper (constr_SEQUENCE.c:1181) ==5215== by 0x807A5B1: uper_open_type_get_simple (per_opentype.c:116) ==5215== by 0x807ACB4: uper_open_type_get (per_opentype.c:264) ==5215== by 0x8078BE2: OPEN_TYPE_uper_get (OPEN_TYPE.c:333) ==5215== by 0x805998D: SEQUENCE_decode_uper (constr_SEQUENCE.c:1178) ==5215== by 0x8079BFC: uper_decode (per_decoder.c:83) ==5215== by 0x8052207: Decode_SAE_MAP (BSM_SAE_conversions.c:566) ==5215== by 0x80610B9: main (converter-sample.c:114) ==5215== ==5215== ==5215== HEAP SUMMARY: ==5215== in use at exit: 278 bytes in 12 blocks ==5215== total heap usage: 29 allocs, 17 frees, 1,174 bytes allocated ==5215== ==5215== 8 bytes in 2 blocks are definitely lost in loss record 1 of 9 ==5215== at 0x402C109: calloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5215== by 0x806E4D7: NativeInteger_decode_uper (NativeInteger.c:272) ==5215== by 0x80599DE: SEQUENCE_decode_uper (constr_SEQUENCE.c:1181) ==5215== by 0x807A5B1: uper_open_type_get_simple (per_opentype.c:116) ==5215== by 0x807ACB4: uper_open_type_get (per_opentype.c:264) ==5215== by 0x8078BE2: OPEN_TYPE_uper_get (OPEN_TYPE.c:333) ==5215== by 0x805998D: SEQUENCE_decode_uper (constr_SEQUENCE.c:1178) ==5215== by 0x8079BFC: uper_decode (per_decoder.c:83) ==5215== by 0x8052207: Decode_SAE_MAP (BSM_SAE_conversions.c:566) ==5215== by 0x80610B9: main (converter-sample.c:114) ==5215== ==5215== 102 (32 direct, 70 indirect) bytes in 1 blocks are definitely lost in loss record 8 of 9 ==5215== at 0x402C109: calloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5215== by 0x80595C1: SEQUENCE_decode_uper (constr_SEQUENCE.c:1096) ==5215== by 0x80599DE: SEQUENCE_decode_uper (constr_SEQUENCE.c:1181) ==5215== by 0x807A5B1: uper_open_type_get_simple (per_opentype.c:116) ==5215== by 0x807ACB4: uper_open_type_get (per_opentype.c:264) ==5215== by 0x8078BE2: OPEN_TYPE_uper_get (OPEN_TYPE.c:333) ==5215== by 0x805998D: SEQUENCE_decode_uper (constr_SEQUENCE.c:1178) ==5215== by 0x8079BFC: uper_decode (per_decoder.c:83) ==5215== by 0x8052207: Decode_SAE_MAP (BSM_SAE_conversions.c:566) ==5215== by 0x80610B9: main (converter-sample.c:114) ==5215== ==5215== 168 (32 direct, 136 indirect) bytes in 1 blocks are definitely lost in loss record 9 of 9 ==5215== at 0x402C109: calloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5215== by 0x805F3D2: SET_OF_decode_uper (constr_SET_OF.c:928) ==5215== by 0x80599DE: SEQUENCE_decode_uper (constr_SEQUENCE.c:1181) ==5215== by 0x807A5B1: uper_open_type_get_simple (per_opentype.c:116) ==5215== by 0x807ACB4: uper_open_type_get (per_opentype.c:264) ==5215== by 0x8078BE2: OPEN_TYPE_uper_get (OPEN_TYPE.c:333) ==5215== by 0x805998D: SEQUENCE_decode_uper (constr_SEQUENCE.c:1178) ==5215== by 0x8079BFC: uper_decode (per_decoder.c:83) ==5215== by 0x8052207: Decode_SAE_MAP (BSM_SAE_conversions.c:566) ==5215== by 0x80610B9: main (converter-sample.c:114) ==5215== ==5215== LEAK SUMMARY: ==5215== definitely lost: 72 bytes in 4 blocks ==5215== indirectly lost: 206 bytes in 8 blocks ==5215== possibly lost: 0 bytes in 0 blocks ==5215== still reachable: 0 bytes in 0 blocks ==5215== suppressed: 0 bytes in 0 blocks ==5215== ==5215== For counts of detected and suppressed errors, rerun with: -v ==5215== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 0 from 0)

brchiu commented 6 years ago

@Purnanandj, could you share the minimal reproducible example code ? thanks.

Purnanandj commented 6 years ago

@brchiu Thanks for the reply . The code is all SAE generated .c and .hfiles from asn file, the main code for above valgrind report is constr_SEQUENCE.c

brchiu commented 6 years ago

@Purnanandj , I know these .c and .h files are generated from asn file, I have purchased J2735 specification so I can generate them on my own. But I am not sure whether : 1) the leakage comes from your program that does not call necessary free functions through ASN_STRUCT_FREE()/ASN_STRUCT_FREE_CONTENTS_ONLY() macros ? 2) there is indeed leakage inside constr_SEQUENCE.c and/or other files ?

Take the sample sample-MessageFrame-1.per under examples/sample.source.J2735 as an example, I decode it with j2735-dump and there are two leakages result from memory allocation for static variables which are irrelevant to constr_SEQUENCE.c

$ valgrind --leak-check=full --show-leak-kinds=all ./j2735-dump sample-MessageFrame-1.per
==4878== Memcheck, a memory error detector
==4878== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==4878== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==4878== Command: ./j2735-dump sample-MessageFrame-1.per
==4878== 
<MessageFrame>
    <messageId>20</messageId>
    <value>
        <BasicSafetyMessage>
            <coreData>
                <msgCnt>88</msgCnt>
                <id>00 00 00 00</id>
                <secMark>59000</secMark>
                <lat>511041141</lat>
                <long>-1341224725</long>
                <elev>188</elev>
                <accuracy>
                    <semiMajor>255</semiMajor>
                    <semiMinor>255</semiMinor>
                    <orientation>65535</orientation>
                </accuracy>
                <transmission><unavailable/></transmission>
                <speed>0</speed>
                <heading>15290</heading>
                <angle>127</angle>
                <accelSet>
                    <long>2001</long>
                    <lat>2001</lat>
                    <vert>-127</vert>
                    <yaw>0</yaw>
                </accelSet>
                <brakes>
                    <wheelBrakes>
                        10000
                    </wheelBrakes>
                    <traction><unavailable/></traction>
                    <abs><unavailable/></abs>
                    <scs><unavailable/></scs>
                    <brakeBoost><unavailable/></brakeBoost>
                    <auxBrakes><unavailable/></auxBrakes>
                </brakes>
                <size>
                    <width>0</width>
                    <length>0</length>
                </size>
            </coreData>
            <partII>
                <BSMpartIIExtension>
                    <partII-Id>0</partII-Id>
                    <partII-Value>
                        <VehicleSafetyExtensions>
                            <pathHistory>
                                <crumbData>
                                    <PathHistoryPoint>
                                        <latOffset>-131072</latOffset>
                                        <lonOffset>-131072</lonOffset>
                                        <elevationOffset>-2048</elevationOffset>
                                        <timeOffset>1</timeOffset>
                                    </PathHistoryPoint>
                                    <PathHistoryPoint>
                                        <latOffset>131071</latOffset>
                                        <lonOffset>131071</lonOffset>
                                        <elevationOffset>2037</elevationOffset>
                                        <timeOffset>65535</timeOffset>
                                    </PathHistoryPoint>
                                </crumbData>
                            </pathHistory>
                            <pathPrediction>
                                <radiusOfCurve>32767</radiusOfCurve>
                                <confidence>0</confidence>
                            </pathPrediction>
                        </VehicleSafetyExtensions>
                    </partII-Value>
                </BSMpartIIExtension>
            </partII>
        </BasicSafetyMessage>
    </value>
</MessageFrame>
<MessageFrame>
    <messageId>20</messageId>
    <value>
        <BasicSafetyMessage>
            <coreData>
                <msgCnt>89</msgCnt>
                <id>FF 00 00 01</id>
                <secMark>59000</secMark>
                <lat>511041141</lat>
                <long>-1341224725</long>
                <elev>188</elev>
                <accuracy>
                    <semiMajor>255</semiMajor>
                    <semiMinor>255</semiMinor>
                    <orientation>65535</orientation>
                </accuracy>
                <transmission><unavailable/></transmission>
                <speed>0</speed>
                <heading>15290</heading>
                <angle>127</angle>
                <accelSet>
                    <long>2001</long>
                    <lat>2001</lat>
                    <vert>-127</vert>
                    <yaw>0</yaw>
                </accelSet>
                <brakes>
                    <wheelBrakes>
                        10000
                    </wheelBrakes>
                    <traction><unavailable/></traction>
                    <abs><unavailable/></abs>
                    <scs><unavailable/></scs>
                    <brakeBoost><unavailable/></brakeBoost>
                    <auxBrakes><unavailable/></auxBrakes>
                </brakes>
                <size>
                    <width>0</width>
                    <length>0</length>
                </size>
            </coreData>
            <partII>
                <BSMpartIIExtension>
                    <partII-Id>0</partII-Id>
                    <partII-Value>
                        <VehicleSafetyExtensions>
                            <pathHistory>
                                <crumbData>
                                    <PathHistoryPoint>
                                        <latOffset>0</latOffset>
                                        <lonOffset>0</lonOffset>
                                        <elevationOffset>0</elevationOffset>
                                        <timeOffset>1</timeOffset>
                                    </PathHistoryPoint>
                                </crumbData>
                            </pathHistory>
                            <pathPrediction>
                                <radiusOfCurve>0</radiusOfCurve>
                                <confidence>0</confidence>
                            </pathPrediction>
                        </VehicleSafetyExtensions>
                    </partII-Value>
                </BSMpartIIExtension>
            </partII>
        </BasicSafetyMessage>
    </value>
</MessageFrame>
==4878== 
==4878== HEAP SUMMARY:
==4878==     in use at exit: 8,248 bytes in 2 blocks
==4878==   total heap usage: 147 allocs, 145 frees, 16,798 bytes allocated
==4878== 
==4878== 56 bytes in 1 blocks are still reachable in loss record 1 of 2
==4878==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4878==    by 0x13D605: add_bytes_to_buffer (in /media/brchiu/DATA/DocCollect/SoftwareTech/asn1c/asn1c_br6/examples/sample.source.J2735/j2735-dump)
==4878==    by 0x13DBC2: data_decode_from_file (in /media/brchiu/DATA/DocCollect/SoftwareTech/asn1c/asn1c_br6/examples/sample.source.J2735/j2735-dump)
==4878==    by 0x13C829: main (in /media/brchiu/DATA/DocCollect/SoftwareTech/asn1c/asn1c_br6/examples/sample.source.J2735/j2735-dump)
==4878== 
==4878== 8,192 bytes in 1 blocks are still reachable in loss record 2 of 2
==4878==    at 0x4C2FA3F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4878==    by 0x4C31D84: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4878==    by 0x13D8C3: data_decode_from_file (in /media/brchiu/DATA/DocCollect/SoftwareTech/asn1c/asn1c_br6/examples/sample.source.J2735/j2735-dump)
==4878==    by 0x13C829: main (in /media/brchiu/DATA/DocCollect/SoftwareTech/asn1c/asn1c_br6/examples/sample.source.J2735/j2735-dump)
==4878== 
==4878== LEAK SUMMARY:
==4878==    definitely lost: 0 bytes in 0 blocks
==4878==    indirectly lost: 0 bytes in 0 blocks
==4878==      possibly lost: 0 bytes in 0 blocks
==4878==    still reachable: 8,248 bytes in 2 blocks
==4878==         suppressed: 0 bytes in 0 blocks
==4878== 
==4878== For counts of detected and suppressed errors, rerun with: -v
==4878== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

If the example program can not be shared due to some reason, alternative approach to check this problem are : 1) Could you share the raw message you try to decode ? 2) Or you try to decode the raw message using j2735-dump and re-check whether there is still leakage by yourself ?

Purnanandj commented 6 years ago

@brchiu Thanks for the quick reply. converter-example.txt Above is the C code and the data in the buffer is encoded data, which i am decoding and the decoded result. output is ; value MessageFrame ::= { messageId 18, value MapData : { timeStamp 100, msgIssueRevision 10, layerType curveData, layerID 51, dataParameters { processMethod "Hai Hello", geoidUsed "Dear Naveen" }, restrictionList { { id 100, users { basicType weightCompliant } } } } } And the valgrind report is attached valgrind.txt Even this has memory leakage issue.

brchiu commented 6 years ago

@Purnanandj ,

You should change free(saeMap_decoded); to ASN_STRUCT_FREE(asn_DEF_MessageFrame, saeMap_decoded);.

Then you can have the following valgrind output : 

$ valgrind --leak-check=full ./j2735-dump 
==25419== Memcheck, a memory error detector
==25419== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==25419== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==25419== Command: ./j2735-dump
==25419== 
DBG: MAP UPER DECODE SUCCESSFUL with 264 Bytes Consumed

  MAP_msg_Id = 18 

  MAP_msg_MinuteOfTheYear = 100 

  MAP_msg_MsgCnt = 10 

  MAP_msg_Layer_type = 4 

  MAP_msg_Layer_ID = 51 

  rl_id = 100 

  rl_users_basicType = 6 
==25419== 
==25419== HEAP SUMMARY:
==25419==     in use at exit: 0 bytes in 0 blocks
==25419==   total heap usage: 30 allocs, 30 frees, 2,578 bytes allocated
==25419== 
==25419== All heap blocks were freed -- no leaks are possible
==25419== 
==25419== For counts of detected and suppressed errors, rerun with: -v
==25419== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Purnanandj commented 6 years ago

@brchiu Thanks for the Quick and solution. The memory leakage issue is resolved :+1:

nprobert commented 4 years ago

I still get memory leaks and crashes. I've thrown in the towel on this compiler.