Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEGV in RWMol::commitBatchEdit #4122

Closed
hgarrereyn opened this issue May 9, 2021 · 0 comments
Closed

SEGV in RWMol::commitBatchEdit #4122

hgarrereyn opened this issue May 9, 2021 · 0 comments
Labels
Milestone

Comments

@hgarrereyn
Copy link

Describe the bug
After certain sequences of adding/removing atoms in a RWMol in batch edit mode, RWMol::commitBatchEdit can segfault. Depending on the call sequence, this either segfaults which crashes the program or performs a heap-buffer-overflow and reads unallocated heap memory (which is only detectible with ASAN).

To Reproduce
This is reproducible in both C++ and Python. Both of the following examples cause a segfault:

#include <GraphMol/RWMol.h>

int main() {
    RDKit::RWMol *mol = new RDKit::RWMol();
    mol->beginBatchEdit();
    mol->addAtom(true);
    mol->commitBatchEdit();
}
from rdkit.Chem import AllChem as Chem

m = Chem.RWMol()
m.BeginBatchEdit()
m.AddAtom(Chem.Atom(1))
m.CommitBatchEdit()

Expected behavior
Based on this test: https://github.com/rdkit/rdkit/blob/master/Code/GraphMol/catch_graphmol.cpp#L1798-L1809 it seems that adding atoms in batch edit mode is allowed behavior.

Configuration (please complete the following information):

  • RDKit version: 2021.03.01
  • OS: Ubuntu 18.04
  • Python version: Python 3.9.2 (although this bug is not dependent on the python version)

Additional context
In an ASAN build of RDKit, the cpp example above crashes with the following stacktrace:

==20==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f0a29ce06ca bp 0x7fffca805520 sp 0x7fffca8053a0 T0)
==20==The signal is caused by a READ memory access.
==20==Hint: address points to the zero page.
    #0 0x7f0a29ce06c9 in operator bool /usr/local/include/boost/dynamic_bitset/dynamic_bitset.hpp:104:41
    #1 0x7f0a29ce06c9 in RDKit::RWMol::commitBatchEdit() /src/rdkit/Code/GraphMol/RWMol.cpp:512
    #2 0x519ec9 in main poc.cpp:7:10
    #3 0x7f0a1f558bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
    #4 0x41d619 in _start (poc+0x41d619)
@hgarrereyn hgarrereyn added the bug label May 9, 2021
greglandrum added a commit to greglandrum/rdkit that referenced this issue May 10, 2021
@greglandrum greglandrum added this to the 2021_03_2 milestone May 10, 2021
greglandrum added a commit that referenced this issue May 12, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants