free(): invalid pointer, when exiting python

[chrisjohgorman]

Hello,

I'm using feature/gr-iio branch, v3.10.0.0git-341-g131f32c7. When I exit the python script associated with my grc file, it appears to double free in the QT GUI Number Sink's destructor.

[chris@descartes radar]$ ./mfcw.py
free(): invalid pointer
Aborted (core dumped)

When I run this in gdb, I get...

(gdb) run mfcw.py
Starting program: /usr/bin/python mfcw.py
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffe6b80640 (LWP 50441)]
[New Thread 0x7fffe635d640 (LWP 50442)]
[New Thread 0x7fffe5910640 (LWP 50443)]
[Thread 0x7fffe5910640 (LWP 50443) exited]
[New Thread 0x7fffe5910640 (LWP 50444)]
[New Thread 0x7fffe510f640 (LWP 50445)]
---snip---
[New Thread 0x7fff75d9f640 (LWP 50473)]
[New Thread 0x7fff7559e640 (LWP 50476)]
[Thread 0x7fff927fc640 (LWP 50464) exited]
[Thread 0x7fff92ffd640 (LWP 50463) exited]
---snip---
[Thread 0x7fffd7e67640 (LWP 50447) exited]
[Thread 0x7fffb3fff640 (LWP 50454) exited]
[Thread 0x7fff7559e640 (LWP 50476) exited]
[Thread 0x7fff765a0640 (LWP 50472) exited]
[Thread 0x7fff75d9f640 (LWP 50473) exited]
[Thread 0x7fff80ff9640 (LWP 50471) exited]
[Thread 0x7fff817fa640 (LWP 50470) exited]
[Thread 0x7fffe6b80640 (LWP 50441) exited]
[Thread 0x7fff81ffb640 (LWP 50469) exited]
[Thread 0x7fff827fc640 (LWP 50468) exited]
[Thread 0x7fff82ffd640 (LWP 50467) exited]
[Thread 0x7fff837fe640 (LWP 50466) exited]
[Thread 0x7fff83fff640 (LWP 50465) exited]
free(): invalid pointer
Thread 1 "python" received signal SIGABRT, Aborted.
0x00007ffff7a58d22 in raise () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff7a58d22 in raise () at /usr/lib/libc.so.6
#1  0x00007ffff7a42862 in abort () at /usr/lib/libc.so.6
#2  0x00007ffff7a9ad28 in __libc_message () at /usr/lib/libc.so.6
#3  0x00007ffff7aa292a in  () at /usr/lib/libc.so.6
#4  0x00007ffff7aa3cfc in _int_free () at /usr/lib/libc.so.6
#5  0x00007ffff7aa79e8 in free () at /usr/lib/libc.so.6
#6  0x00007fffeb1dfd6f in gr::qtgui::number_sink_impl::~number_sink_impl() ()
    at /usr/local/lib/libgnuradio-qtgui.so.3.10.0git
#7  0x00007fffeb1e0123 in virtual thunk to
gr::qtgui::number_sink_impl::~number_sink_impl() () at
/usr/local/lib/libgnuradio-qtgui.so.3.10.0git
#8  0x00007fffeb356e0a in  ()
    at /usr/local/lib/python3.9/site-packages/gnuradio/qtgui/qtgui_python.cpython-39-x86_64-linux-gnu.so
#9  0x00007fffeb37bce6 in  ()
    at /usr/local/lib/python3.9/site-packages/gnuradio/qtgui/qtgui_python.cpython-39-x86_64-linux-gnu.so
#10 0x00007fffeb34f9c4 in  ()
    at /usr/local/lib/python3.9/site-packages/gnuradio/qtgui/qtgui_python.cpython-39-x86_64-linux-gnu.so
#11 0x00007ffff7d09cb6 in  () at /usr/lib/libpython3.9.so.1.0
#12 0x00007ffff6d98f26 in  ()
    at /usr/lib/python3.9/site-packages/PyQt5/sip.cpython-39-x86_64-linux-gnu.so
#13 0x00007ffff6d9a194 in  ()
    at /usr/lib/python3.9/site-packages/PyQt5/sip.cpython-39-x86_64-linux-gnu.so
#14 0x00007ffff7d029ac in  () at /usr/lib/libpython3.9.so.1.0
#15 0x00007ffff7dc17de in  () at /usr/lib/libpython3.9.so.1.0
#16 0x00007ffff7df09ba in PyGC_Collect () at /usr/lib/libpython3.9.so.1.0
#17 0x00007ffff7dee8a9 in Py_FinalizeEx () at /usr/lib/libpython3.9.so.1.0
#18 0x00007ffff7de643c in Py_RunMain () at /usr/lib/libpython3.9.so.1.0
#19 0x00007ffff7db7349 in Py_BytesMain () at /usr/lib/libpython3.9.so.1.0
#20 0x00007ffff7a43b25 in __libc_start_main () at /usr/lib/libc.so.6
#21 0x000055555555504e in _start ()

Thanks,

Chris

[willcode]

delete d_argv; should check whether d_argv == NULL first.

gnuradio/gr-qtgui/lib/number_sink_impl.cc

Line 75 in 04f1eb0

delete d_argv;

[marcusmueller]

delete d_argv; should check whether d_argv == NULL first.

gnuradio/gr-qtgui/lib/number_sink_impl.cc

Line 75 in 04f1eb0

delete d_argv;

I don't think this should ever be deleted; the memory it points to is a member of the class, not allocated by new.