#1054080 stlcmd: stl_boolean segfaults on some inputs

Package:
stlcmd
Source:
stlcmd
Description:
Suite of commands for generating, inspecting and manipulating STL files
Submitter:
Sebastian Kuzminsky
Date:
2024-11-08 14:12:02 UTC
Severity:
normal
#1054080#5
Date:
2023-10-16 18:57:53 UTC
From:
To:
Dear Maintainer,

   * What led up to the situation?

I want to see the difference between two STL files.  I ran the following
commands:

    $ stl_boolean -a one.stl -b two.stl -i intersection.stl
    $ stl_boolean -a one.stl -b intersection.stl -d one-additions.stl
    $ stl_boolean -a two.stl -b intersection.stl -d two-additions.stl

Both of the two `-d` commands failed, stl_boolean segfaulted before producing any output.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

I then cloned the upstream repo, which is several commits ahead of
the v1.1 tag that the current debian package is based on, and those
executables worked fine.

#1054080#10
Date:
2024-05-06 20:20:30 UTC
From:
To:
Hello,
I am not maintainer of stlcmd, just tried to collect some more information.

This crash seems to be a stack overflow because of a recursive function call.

There is a comment near that recursive call, which could be interesting here.
And this issue seems not to be a packaging issue in Debian, therefore it
might be better to report this issue upstream in [2].

Kind regards,
Bernhard

[1] https://github.com/AllwineDesigns/stl_cmd/blob/7c2582864df1c10d11f5acb4901fb04c55ea7492/src/csgjs/Trees.cpp#L44-L55
[2] https://github.com/AllwineDesigns/stl_cmd/issues


Core was generated by `stl_boolean -a one.stl -b intersection.stl -d one-additions.stl'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fe2a95c855e in _int_malloc (av=av@entry=0x7fe2a9712b80 <main_arena>, bytes=bytes@entry=512) at malloc.c:3637
3637    malloc.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0  0x00007fe2a95c855e in _int_malloc (av=av@entry=0x7fe2a9712b80 <main_arena>, bytes=bytes@entry=512) at malloc.c:3637
#1  0x00007fe2a95c9de4 in __GI___libc_malloc (bytes=512) at malloc.c:3058
#2  0x00007fe2a991c0b5 in operator new(unsigned long) () from /lib/x86_64-linux-gnu/libstdc++.so.6
#3  0x000056309140a744 in __gnu_cxx::new_allocator<csgjs::PolygonTreeNode*>::allocate (this=<optimized out>, __n=<optimized out>) at /usr/include/c++/7/ext/new_allocator.h:111
#4  std::allocator_traits<std::allocator<csgjs::PolygonTreeNode*> >::allocate (__a=..., __n=<optimized out>) at /usr/include/c++/7/bits/alloc_traits.h:436
#5  std::_Vector_base<csgjs::PolygonTreeNode*, std::allocator<csgjs::PolygonTreeNode*> >::_M_allocate (this=0x210, this@entry=0x7fff7ccf8470, __n=<optimized out>) at /usr/include/c++/7/bits/stl_vector.h:172
#6  std::vector<csgjs::PolygonTreeNode*, std::allocator<csgjs::PolygonTreeNode*> >::_M_realloc_insert<csgjs::PolygonTreeNode* const&> (this=this@entry=0x7fff7ccf8470, __position=<error reading variable: Cannot access memory at address 0x200>, __args#0=@0x7fff7ccf82a0: 0x563093c75b00) at /usr/include/c++/7/bits/vector.tcc:406
#7  0x000056309140a84b in std::vector<csgjs::PolygonTreeNode*, std::allocator<csgjs::PolygonTreeNode*> >::emplace_back<csgjs::PolygonTreeNode*> (this=this@entry=0x7fff7ccf8470, __args#0=@0x7fff7ccf82a0: 0x563093c75b00) at /usr/include/c++/7/bits/vector.tcc:105
#8  0x0000563091409a9a in std::vector<csgjs::PolygonTreeNode*, std::allocator<csgjs::PolygonTreeNode*> >::push_back (__x=@0x7fff7ccf82a0: 0x563093c75b00, this=0x7fff7ccf8470) at /usr/include/c++/7/bits/stl_vector.h:954
#9  csgjs::PolygonTreeNode::splitPolygonByPlane (this=this@entry=0x563093c75b00, plane=..., coplanarFrontNodes=std::vector of length 0, capacity 0, coplanarBackNodes=std::vector of length 32, capacity 32 = {...},  frontNodes=std::vector of length 0, capacity 0, backNodes=std::vector of length 32, capacity 32 = {...}) at src/csgjs/Trees.cpp:298
#10 0x0000563091409d7c in csgjs::PolygonTreeNode::splitLeafByPlane (this=0x563093c75b00, plane=..., coplanarFrontNodes=std::vector of length 0, capacity 0,  coplanarBackNodes=std::vector of length 32, capacity 32 = {...}, frontNodes=std::vector of length 0, capacity 0, backNodes=std::vector of length 32, capacity 32 = {...}) at src/csgjs/Trees.cpp:239
#11 0x0000563091409f67 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563096390cc0, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:40
#12 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563096390a50, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#13 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x5630963907e0, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#14 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563096390570, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#15 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563096390300, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
...
#65433 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c99510, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#65434 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c994b0, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#65435 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c99880, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#65436 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c99820, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#65437 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c997c0, polyTreeNodes=std::vector of length 60, capacity 64 = {...}) at src/csgjs/Trees.cpp:54
#65438 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c99720, polyTreeNodes=std::vector of length 113, capacity 128 = {...}) at src/csgjs/Trees.cpp:54
#65439 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c68e20, polyTreeNodes=std::vector of length 497, capacity 512 = {...}) at src/csgjs/Trees.cpp:54
#65440 0x0000563091409ff8 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c6e370, polyTreeNodes=std::vector of length 844, capacity 1024 = {...}) at src/csgjs/Trees.cpp:49
#65441 0x0000563091409ff8 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c831b0, polyTreeNodes=std::vector of length 1352, capacity 2048 = {...}) at src/csgjs/Trees.cpp:49
#65442 0x0000563091409ff8 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c944b0, polyTreeNodes=std::vector of length 2397, capacity 4096 = {...}) at src/csgjs/Trees.cpp:49
#65443 0x0000563091409ff8 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c6ab00, polyTreeNodes=std::vector of length 2399, capacity 4096 = {...}) at src/csgjs/Trees.cpp:49
#65444 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c10c30, polyTreeNodes=std::vector of length 3661, capacity 4096 = {...}) at src/csgjs/Trees.cpp:54
#65445 0x0000563091409ff8 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c594c0, polyTreeNodes=std::vector of length 4549, capacity 8192 = {...}) at src/csgjs/Trees.cpp:49
#65446 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x563093c59440, polyTreeNodes=std::vector of length 7573, capacity 8192 = {...}) at src/csgjs/Trees.cpp:54
#65447 0x000056309140a061 in csgjs::Node::addPolygonTreeNodes (this=this@entry=0x7fff7d4f54b0, polyTreeNodes=std::vector of length 14308, capacity 14308 = {...}) at src/csgjs/Trees.cpp:54
#65448 0x000056309140a189 in csgjs::Tree::addPolygons (this=this@entry=0x7fff7d4f54b0, polygons=std::vector of length 14308, capacity 14308 = {...}) at src/csgjs/Trees.cpp:119
#65449 0x000056309140a28e in csgjs::Tree::Tree (this=0x7fff7d4f54b0, polygons=std::vector of length 14308, capacity 14308 = {...}) at src/csgjs/Trees.cpp:105
#65450 0x0000563091402c2b in csgjs::CSG::csgSubtract (this=this@entry=0x7fff7d4f5650, csg=...) at src/csgjs/CSG.cpp:64
#65451 0x00005630914018e2 in main (argc=<optimized out>, argv=<optimized out>) at src/stl_boolean.cpp:127
(gdb)