FMS icon indicating copy to clipboard operation
FMS copied to clipboard

`test_xgrid` keeps local temporaries (use after free)

Open foxtran opened this issue 2 months ago • 0 comments

Describe the bug

In the following fragment, local temporaries atm_data_in+K are used for putting them on grid: https://github.com/NOAA-GFDL/FMS/blob/f13435f7a23f24d9eebcf01ca520cd67851b087b/test_fms/exchange/test_xgrid.F90#L918-L921 put_on_xgrid, internally, keeps pointers to these local temporaries and uses them for some updating at: https://github.com/NOAA-GFDL/FMS/blob/f13435f7a23f24d9eebcf01ca520cd67851b087b/test_fms/exchange/test_xgrid.F90#L921 complete=.true. routes when the updating should happen.

However, actual generated code is (some Fortran-like pseudocode):

    call put_to_xgrid(atm_data_in, 'ATM', x_1, Xmap, remap_method=remap_method)
    allocate(local_tmp1(shape(atm_data_in))
    local_tmp1 = atm_data_in + 1
    call put_to_xgrid(local_tmp1, 'ATM', x_2, Xmap, remap_method=remap_method, complete=.false.)
    deallocate (local_tmp1)
    allocate(local_tmp2(shape(atm_data_in))
    local_tmp2 = atm_data_in + 2
    call put_to_xgrid(local_tmp2, 'ATM', x_3, Xmap, remap_method=remap_method, complete=.false.)
    deallocate (local_tmp2)
    allocate(local_tmp3(shape(atm_data_in))
    local_tmp3 = atm_data_in + 3
    call put_to_xgrid(local_tmp3, 'ATM', x_4, Xmap, remap_method=remap_method, complete=.true.)
    deallocate (local_tmp3)

So, at compete=true, app uses already deallocated memory of local_tmp1 and local_tmp2.

To Reproduce Compile with -fsanitize=address and run tests

Expected behavior No ASan errors.

System Environment See FMS CI setup

Additional context I've raised ASan errors in CI of this repo via modifing FFLAGS and LDFLAGS.

foxtran avatar Dec 09 '25 13:12 foxtran