Skip to content

Invalid memory access in RooArgSet::contentsString() with an empty RooArgSet #20189

@TomasDado

Description

@TomasDado

Check duplicate issues.

  • Checked for duplicates

Description

While debugging a crash in TRExFitter, I found out that the following code:

void myString() {
    RooArgSet s;
    std::string myString = s.contentsString();
    std::cout << "my string: " << myString << "\n";
}

Results in an invalid string, in my case:

tomas@tomas-pc:~/TRExFitter$ root -l myString.cxx 
root [0] 
Processing myString.cxx...
my string: ���@Y ]��@Yȃ}��f|���e|&��@Y���@Y��}�3p�f|p�}��	\_|P^��@Y��
                                                                           )*h�F�@Yp�}�@�}� ]��@Y0�}���T_|h�F�@Y�g�@YG]_|��F�@Y��
                                                                                                                                 )* ]��@Yp�}���}��}���}�H�T_|�[��@�,����� ]��@Y��}��e|P���@Ygn7��
                                                                                                                                                                                                 )*f| ]��@Yp�N�@YP�}�0�}��e|�}b_|��}�p�}�@�}���}��}����@Y@�}� �}��}� �}����@Y�e|@�}��}myString0�}myStringP�␦�@Y7V()}�������}�0�}��0c_|��
                                                                                )*����%p�}�
                                                                                            �}�0�}�
                                                                                                   X@c_|@�}��[��@Y
                                                                                                                  |%%@�}�()}� �}�root [1] .q

This is caused by this line: https://github.com/root-project/root/blob/master/roofit/roofitcore/src/RooAbsCollection.cxx#L1157 which has no protection for an empty string.

Reproducer

See above

ROOT version

ROOT Version: 6.37.01
Built for linuxx8664gcc on Oct 24 2025, 06:58:40
From heads/master@v6-37-01-8567-gfd42da9fb

Installation method

built from source

Operating system

Ubuntu 25.04

Additional context

No response

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Status

No status

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions