fix segfault when node fusing encounters the end of a chain

When processing a chain of nodes, rebuild_vlists() would encounter and then
dereference a NULL pointer on reaching the end of the chain. See included test
case for a sample of how to reproduce this. Fixes #1436.

diff --git a/ChangeLog b/ChangeLog
index f1963816a21a83cca95a34db513751bd3604471f..8962b728d470f23b80ec113251a662736d75d9a1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+June 8, 2020
+    - Fixed:
+        - Segmentation fault (core dumped) #1436
 June 2, 2020
     - Fixed:
         - Neato's hier mode is broken since v2.44.0 #1726

diff --git a/lib/dotgen/conc.c b/lib/dotgen/conc.c
index f7307d23b3ff9151b283c9b045892a80c0d6c055..1b4f3671f87a128193335f5e7ca59db13eef406e 100644 (file)
--- a/lib/dotgen/conc.c
+++ b/lib/dotgen/conc.c
@@ -150,7 +150,7 @@ static void rebuild_vlists(graph_t * g)
        infuse(g, n);
        for (e = agfstout(g, n); e; e = agnxtout(g, e)) {
            for (rep = e; ED_to_virt(rep); rep = ED_to_virt(rep));
-           while (ND_rank(aghead(rep)) < ND_rank(aghead(e))) {
+           while (rep != NULL && ND_rank(aghead(rep)) < ND_rank(aghead(e))) {
                infuse(g, aghead(rep));
                rep = ND_out(aghead(rep)).list[0];
            }

diff --git a/rtest/1436.dot b/rtest/1436.dot
new file mode 100644 (file)
index 0000000..8129a0e
--- /dev/null
+++ b/rtest/1436.dot
@@ -0,0 +1,166 @@
+digraph{
+graph[
+concentrate=true
+]
+{
+{
+subgraph cluster{
+{
+{
+subgraph cluster{
+"tmp-outdir/2oa0yj8_"[
+]
+{
+{
+"tmp-outdir/i97092_3"[
+]
+}
+}
+"tmp-outdir/e_0svw5g"[
+]
+"pgap_cwltool_mg37/tmp-outdir/e_0svw5g/entries.asnb"[
+]
+"tmp-outdir/d51w65ir"[
+]
+}
+}
+}
+{
+{
+subgraph cluster{
+"tmp-outdir/4vpjdl_x"[
+]
+""[
+]
+"tmp-outdir/n6biqth4"[
+]
+}
+}
+}
+{
+{
+subgraph cluster{
+"tmp-outdir/_fqw3_kw"[
+]
+"pgap_cwltool_mg37/tmp-outdir/_fqw3_kw/oseq-ids.seqids"[
+]
+"tmp-outdir/jfr1y8yx"[
+]
+"pgap_cwltool_mg37/tmp-outdir/jfr1y8yx/ref_no_organelle.gi"[
+]
+}
+}
+}
+subgraph cluster{
+{
+{
+"tmp-outdir/lhupur9o"[
+]
+"pgap_cwltool_mg37/tmp-outdir/lhupur9o/mapped-hmm-hits.asn"[
+]
+{
+{
+{
+{
+"tmp-outdir/rokz370o"[
+]
+}
+}
+}
+}
+}
+}
+"pgap_cwltool_mg37/tmp-outdir/5b96qv5l/meta.annot.val"[
+]
+}
+{
+{
+{
+"tmp-outdir/0la_z8p7"[
+]
+"pgap_cwltool_mg37/tmp-outdir/0la_z8p7/preliminary-models.asn"[
+]
+{
+{
+"8"[
+]
+}
+}
+"tmp-outdir/v2k85rhb"[
+]
+}
+}
+}
+{
+{
+subgraph cluster{
+"tmp-outdir/egrgh9jw"[
+]
+{
+0{
+"tmp-outdir/vez4jla2"[
+]
+}
+}
+"tmp-outdir/nl3k85s0"[
+]
+{
+{
+"tmp-outdir/gf63j60v"[
+]
+"pgap_cwltool_mg37/tmp-outdir/f08tgqk2/jobs.xml"[
+]
+}
+}
+}
+}
+}
+subgraph cluster8{
+{
+{
+{
+{
+"tmp-outdir/4yudji6n"[
+]
+}
+}
+}
+}
+"pgap_cwltool_mg37/tmp-outdir/dfkqpwml/sequences.asn"[
+]
+}
+{
+"tmp-outdir/5wsqksxv"[
+]
+}
+}
+}
+}
+
+"tmp-outdir/_fqw3_kw"->"tmp-outdir/vez4jla2"
+"tmp-outdir/n6biqth4"->"tmp-outdir/vez4jla2"
+"tmp-outdir/d51w65ir"->"tmp-outdir/0la_z8p7"
+"tmp-outdir/i97092_3"->"tmp-outdir/rokz370o"
+"tmp-outdir/_fqw3_kw"->"tmp-outdir/rokz370o"
+
+
+"tmp-outdir/_fqw3_kw"->"tmp-outdir/4vpjdl_x"
+"tmp-outdir/_fqw3_kw"->"tmp-outdir/egrgh9jw"
+
+"tmp-outdir/_fqw3_kw"->"tmp-outdir/nl3k85s0"
+"pgap_cwltool_mg37/tmp-outdir/f08tgqk2/jobs.xml"->"tmp-outdir/gf63j60v"
+"pgap_cwltool_mg37/tmp-outdir/_fqw3_kw/oseq-ids.seqids"->"tmp-outdir/4vpjdl_x"
+"l"->"/"
+"pgap_cwltool_mg37/tmp-outdir/dfkqpwml/sequences.asn"->"tmp-outdir/e_0svw5g"
+"pgap_cwltool_mg37/tmp-outdir/jfr1y8yx/ref_no_organelle.gi"->"tmp-outdir/4yudji6n"
+"pgap_cwltool_mg37/tmp-outdir/jfr1y8yx/ref_no_organelle.gi"->"tmp-outdir/2oa0yj8_"
+"2"->"."
+"pgap_cwltool_mg37/tmp-outdir/e_0svw5g/entries.asnb"->"tmp-outdir/i97092_3"
+"tmp-outdir/0la_z8p7"->"pgap_cwltool_mg37/tmp-outdir/0la_z8p7/preliminary-models.asn"
+"tmp-outdir/jfr1y8yx"->"pgap_cwltool_mg37/tmp-outdir/jfr1y8yx/ref_no_organelle.gi"
+"pgap_cwltool_mg37/tmp-outdir/0la_z8p7/preliminary-models.asn"->"tmp-outdir/v2k85rhb"
+"pgap_cwltool_mg37/tmp-outdir/lhupur9o/mapped-hmm-hits.asn"->"tmp-outdir/gf63j60v"
+"b"
+"tmp-outdir/lhupur9o"->"pgap_cwltool_mg37/tmp-outdir/lhupur9o/mapped-hmm-hits.asn"
+"pgap_cwltool_mg37/tmp-outdir/5b96qv5l/meta.annot.val"->"tmp-outdir/5wsqksxv"
+}

diff --git a/rtest/test_regression.py b/rtest/test_regression.py
index 16d6f03556b91d1768677d5a120b11f9c154265f..b169ed139231e9361722eabbc4d288b4179948c8 100644 (file)
--- a/rtest/test_regression.py
+++ b/rtest/test_regression.py
@@ -31,3 +31,17 @@ def test_regression_failure():
     assert "Layout failures: 0" in str(text)
 # FIXME: re-enable when all tests pass on all platforms
 #    assert result.returncode == 0
+
+def test_1436():
+    '''
+    test a segfault from https://gitlab.com/graphviz/graphviz/-/issues/1436 has
+    not reappeared
+    '''
+
+    # locate our associated test case in this directory
+    input = os.path.join(os.path.dirname(__file__), '1436.dot')
+    assert os.path.exists(input), 'unexpectedly missing test case'
+
+    # ask Graphviz to process it, which should generate a segfault if this bug
+    # has been reintroduced
+    subprocess.check_call(['dot', '-Tsvg', '-o', os.devnull, input])