Fix tutor2pp segfault from double-free in createObjects - #1426
Open
mchamberland wants to merge 1 commit into
Open
Fix tutor2pp segfault from double-free in createObjects#1426mchamberland wants to merge 1 commit into
mchamberland wants to merge 1 commit into
Conversation
createObjects() always deleted its local input pointer, but when the caller already passed a section block (as EGS_SimpleApplication does for source definition), the caller deleted the same pointer again. Only delete the input when createObjects extracted the section via takeInputItem(), matching the ownership pattern already used in createGeometry(). Fixes nrc-cnrc#1140 Co-authored-by: Cursor <cursoragent@cursor.com>
rtownson
approved these changes
Jun 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tutor2pp(and any user code derived fromEGS_SimpleApplication) caused by a double-free inEGS_ObjectFactory::createObjects().createObjects()now deletes its workingEGS_Inputpointer only when it extracted the section itself viatakeInputItem(), matching the ownership pattern already used inEGS_BaseGeometry::createGeometry().Fixes #1140
Root cause
EGS_SimpleApplicationtakes thesource definitionblock from the input file, passes that pointer toEGS_BaseSource::createSource(), and then deletes it. InsidecreateSource()→createObjects(), when the argument is already asource definitionsection, the localinputpointer aliases the caller's pointer. An unconditionaldelete inputat the end ofcreateObjects()(added in def34e2 to fix a sanitizer-reported leak) freed memory thatEGS_SimpleApplicationthen deleted again.Advanced applications (
EGS_AdvancedApplication, egs_brachy, tutor7pp, etc.) were unaffected because they pass the full input file;createObjects()takes the section internally and owns that extracted pointer.Reasoning / alignment with #1140
Ernesto Mainegra identified the same cause on #1140 and suggested two approaches:
createObjectsso the factory frees its copy while the caller keeps the original.egs_simple_application.cpp(Matt Inglis Whalen's workaround was to removedelete source_inputentirely).This PR follows option 1 in intent—make ownership explicit at the factory—without copying
EGS_Input. When the caller passes an already-extracted section,createObjects()leaves it for the caller to delete; when it extracts the section from a larger input (the advanced-application path), it deletes what it took. That preserves the 2021 leak fix for the advanced path while fixing the SimpleApplication double-free, and avoids the leak that would result from simply removingdelete source_inputinegs_simple_application.cpp.Test plan
libegsppand runtutor2pp -i test1.egsinp -p tutor_dataon macOS (eb-dev config): completes with deposited/transmitted energy fractions.tutor2ppand anEGS_AdvancedApplicationexample still run on Linux.Made with Cursor