#845492 graphviz: Double free() for dot files with multiple digraphs

Package:
graphviz
Source:
graphviz
Description:
rich set of graph drawing tools
Submitter:
Stephan Diestelhorst
Date:
2026-07-14 22:03:01 UTC
Severity:
important
#845492#5
Date:
2016-11-23 21:45:21 UTC
From:
To:
Dear Maintainer,

   The dot tool has had random crahses for dot files with multiple
   digraphs, sometimes leading to glib detected malloc / free
   corruption.

   I have tested this with the Address Sanitizer and Valgrind Memcheck,
   and found a simple memory leak (that I fixed), and a double free of
   the ranks (that I also fixed), and several lost memory allocations
   aka leaks, that I have not managed to fix, as they are somewhat
   secondary.

   This is an Ubuntu package, but I believe the issue to be still
   present in the Debian package.  Upstream bug tracking is tedious, so
   I am submitting here, instead.

   Thanks,
     Stephan
#845492#10
Date:
2016-11-24 10:14:00 UTC
From:
To:
Attaching valgrind memcheck logs going from broken to fixed.

Hope that is useful.

Thanks,
  Stephan
#845492#15
Date:
2026-07-14 22:01:34 UTC
From:
To:
It’s not clear to me exactly how to repro this. My naive attempt:

   $ cat >/tmp/845492.dot <<EOT -
   digraph {
     a -> b;
   }
   digraph {
     a -> b;
   }
   EOT
   $ dot /tmp/845492.dot

does not trigger the bug in an upstream build of the latest head
(aef8a6fd874726f17e3797561d23491bd9e156fa) with Address Sanitizer
enabled. From Git history, one would guess
690833989718642337055595cba1d4aedc0730d4
(https://gitlab.com/graphviz/graphviz/-/commit/690833989718642337055595cba1d4aedc0730d4)
was the fixing commit. But the above steps do not trigger the bug prior
to this commit either.

Rewinding to 2.38.0 (f54ac2c9313ae80ccf76ef4ac6aa9be820a23126), I _can_
trigger an ASan crash with the above steps. But bisecting this just
lands on 908a139753380160563a9d3dbf17fe3d3e4d6fdc
(https://gitlab.com/graphviz/graphviz/-/commit/908a139753380160563a9d3dbf17fe3d3e4d6fdc),
the familiar fix to unrelated issues like
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698066,
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700813.

So if the above steps are indeed enough to repro this, we have evidence
this was fixed upstream but no further information on when or how.