Segfault in `MakeINCHIFromMolfileText`

[JanCBrammer]

MakeINCHIFromMolfileText segfaults with

Ferrocene
  ACCLDraw12122514483D

  0  0  0     0  0            999 V3000
M  V30 BEGIN CTAB
M  V30 COUNTS 13 12 0 0 0
M  V30 BEGIN ATOM
M  V30 1 C 19.44 -22.4142 -0.1542 0 
M  V30 2 C 19.8251 -23.417 0.6958 0 
M  V30 3 C 21.204 -23.4477 0.7167 0 
M  V30 4 C 21.6716 -22.4638 -0.0917 0 
M  V30 5 C 20.5725 -21.854 -0.7083 0 CHG=-1 CFG=3 
M  V30 6 * 20.4688 -22.625 0 0 
M  V30 7 Fe 20.4134 -20.7234 0 0 
M  V30 8 * 20.5 -19.1875 0 0 
M  V30 9 C 20.5767 -18.3331 -0.7083 0 CHG=-1 CFG=3 
M  V30 10 C 19.44 -18.8933 -0.1542 0 
M  V30 11 C 19.8251 -19.8962 0.6958 0 
M  V30 12 C 21.6716 -18.943 -0.0917 0 
M  V30 13 C 21.204 -19.9269 0.7167 0 
M  V30 END ATOM
M  V30 BEGIN BOND
M  V30 1 2 1 2 
M  V30 2 1 2 3 
M  V30 3 2 3 4 
M  V30 4 1 4 5 
M  V30 5 1 5 1 
M  V30 6 9 7 6 ENDPTS=(5 5 1 2 4 3) ATTACH=ALL
M  V30 7 9 7 8 ENDPTS=(5 9 10 11 12 13) ATTACH=ALL
M  V30 8 1 9 10 
M  V30 9 2 10 11 
M  V30 10 1 12 9 
M  V30 11 1 11 13 
M  V30 12 2 13 12 
M  V30 END BOND
M  V30 END CTAB
M  END

Originally reported in IUPAC-InChI/InChI-Web-Demo#25.
Reproduced with 8feee9e.

How to reproduce the issue

The following commands all run from the root directory.
Compile the test
./INCHI-1-TEST/build_with_cmake.sh all
Run the test
CMake_build/full_build/INCHI-1-TEST/tests/test_unit/test_inchi_dll_b
The test run should finish with

[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from inchi_dll_b_testing
[ RUN      ] inchi_dll_b_testing.test_MakeINCHIFromMolfileText
[       OK ] inchi_dll_b_testing.test_MakeINCHIFromMolfileText (115 ms)
[----------] 1 test from inchi_dll_b_testing (115 ms total)

[----------] Global test environment tear-down
[==========] 1 test from 1 test suite ran. (115 ms total)
[  PASSED  ] 1 test.

Note that the test passes because we're asserting a segfault:

InChI/INCHI-1-TEST/tests/test_unit/test_inchi_dll_b.cpp

Lines 85 to 86 in 8feee9e

	// We match any error because the test crashes with different error across runs (i.e., flaky test).
	ASSERT_DEATH(MakeINCHIFromMolfileText(ferrocene, options, poutput), ".*");

[JanCBrammer]

Initial debugging.
Compile test (from root dir): ./INCHI-1-TEST/build_with_cmake.sh all.
Run test under debugger (from root dir): gdb CMake_build/full_build/INCHI-1-TEST/tests/test_unit/test_inchi_dll_b.

gdb provides the following traceback:

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
#1  0x00007f0e963489ff in __pthread_kill_internal (threadid=<optimized out>, signo=6)
    at ./nptl/pthread_kill.c:89
#2  0x00007f0e962f3cc2 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f0e962dc4ac in __GI_abort () at ./stdlib/abort.c:73
#4  0x00007f0e962dd291 in __libc_message_impl (fmt=fmt@entry=0x7f0e9645f32d "%s\n")
    at ../sysdeps/posix/libc_fatal.c:134
#5  0x00007f0e96352465 in malloc_printerr (
    str=str@entry=0x7f0e96462058 "free(): double free detected in tcache 2") at ./malloc/malloc.c:5829
#6  0x00007f0e963524f6 in tcache_double_free_verify (e=e@entry=0x5fc3ba4f2fd0, tc_idx=tc_idx@entry=1)
    at ./malloc/malloc.c:3240
#7  0x00007f0e96357430 in tcache_free (p=0x5fc3ba4f2fc0, size=48) at ./malloc/malloc.c:3263
#8  _int_free (av=0x7f0e9649bac0 <main_arena>, p=0x5fc3ba4f2fc0, have_lock=0) at ./malloc/malloc.c:4695
#9  __GI___libc_free (mem=0x5fc3ba4f2fd0) at ./malloc/malloc.c:3476
#10 0x00007f0e968e2d9b in NumLists_Free (num_lists=0x5fc3ba4f3a50)
    at /workspaces/InChI/INCHI-1-SRC/INCHI_BASE/src/mol_fmt4.c:497
#11 0x00007f0e968e01da in DeleteMolfileV3000Info (v3000=0x5fc3ba4f39c0)
    at /workspaces/InChI/INCHI-1-SRC/INCHI_BASE/src/mol_fmt3.c:182
#12 0x00007f0e968dfe46 in FreeMolfileData (mfdata=mfdata@entry=0x5fc3ba4f3750)
    at /workspaces/InChI/INCHI-1-SRC/INCHI_BASE/src/mol_fmt2.c:689
#13 0x00007f0e968e6a9d in ReadMolfileToInpAtoms (inp_file=inp_file@entry=0x7ffde6a1a0b0, 
    bDoNotAddH=bDoNotAddH@entry=0, at=at@entry=0x7ffde6a19ad0, szCoord=szCoord@entry=0x7ffde6a19ac8, 
    polymer=polymer@entry=0x7ffde6a19ac0, v3000=v3000@entry=0x7ffde6a19ab8, treat_polymers=0, treat_NPZz=0, 
    max_num_at=1024, num_dimensions=0x7ffde6a19adc, num_bonds=0x7ffde6a19ad8, pSdfLabel=0x0, pSdfValue=0x0, 
    Id=0x7ffde6a1a4c8, lMolfileNumber=0x7ffde6a1a4d0, pInpAtomFlags=0x7ffde6a19b90, err=0x7ffde6a1a310, 
    pStrErr=0x7ffde6a1a314 "V3000 star atoms ignored; V3000 haptic bonds read/stored but ignored; Out of RAM", bNoWarnings=0) at /workspaces/InChI/INCHI-1-SRC/INCHI_BASE/src/mol2atom.c:499
#14 0x00007f0e968e6e91 in CreateOrigInpDataFromMolfile (inp_file=inp_file@entry=0x7ffde6a1a0b0, 
    orig_at_data=orig_at_data@entry=0x7ffde6a1a280, bMergeAllInputStructures=<optimized out>, 
    bGetOrigCoord=bGetOrigCoord@entry=1, bDoNotAddH=0, treat_polymers=0, treat_NPZz=0, pSdfLabel=0x0, 
    pSdfValue=0x0, lSdfId=0x7ffde6a1a4c8, lMolfileNumber=0x7ffde6a1a4d0, pInpAtomFlags=0x7ffde6a19b90, 
    err=0x7ffde6a1a310, 
    pStrErr=0x7ffde6a1a314 "V3000 star atoms ignored; V3000 haptic bonds read/stored but ignored; Out of RAM", bNoWarnings=0) at /workspaces/InChI/INCHI-1-SRC/INCHI_BASE/src/mol2atom.c:156
#15 0x00007f0e968ef3a0 in ReadTheStructure (ic=ic@entry=0x7ffde6a1a030, sd=sd@entry=0x7ffde6a1a300, 
    ip=ip@entry=0x7ffde6a1a470, inp_file=inp_file@entry=0x7ffde6a1a0b0, 
    orig_inp_data=orig_inp_data@entry=0x7ffde6a1a280, inp_index=inp_index@entry=-1, 
    out_index=<optimized out>) at /workspaces/InChI/INCHI-1-SRC/INCHI_BASE/src/runichi2.c:470
#16 0x00007f0e968ef925 in GetOneStructure (ic=ic@entry=0x7ffde6a1a030, sd=sd@entry=0x7ffde6a1a300, 
    ip=ip@entry=0x7ffde6a1a470, szTitle=szTitle@entry=0x7ffde6a1a5e0 <incomplete sequence \362>, 
    inp_file=inp_file@entry=0x7ffde6a1a0b0, log_file=log_file@entry=0x7ffde6a1a110, out_file=0x7ffde6a1a140, 
    prb_file=0x7ffde6a1a0e0, orig_inp_data=0x7ffde6a1a280, num_inp=0x7ffde6a1a828, struct_fptrs=0x0)
    at /workspaces/InChI/INCHI-1-SRC/INCHI_BASE/src/runichi2.c:229
#17 0x00007f0e968130ce in MakeINCHIFromMolfileText (
    moltext=0x5fc389ec8040 "Ferrocene\n  ACCLDraw12122514483D\n\n  0  0  0     0  0", ' ' <repeats 12 times>, "999 V3000\nM  V30 BEGIN CTAB\nM  V30 COUNTS 13 12 0 0 0\nM  V30 BEGIN ATOM\nM  V30 1 C 19.44 -22.4142 -0.1542 0 \nM  V30 2 C 19.8251 -23.417 "..., szOptions=<optimized out>, result=0x7ffde6a1a890)
    at /workspaces/InChI/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll_b.c:179

[JanCBrammer]

According to git bisect the commit that introduces the bug is 348c9c9.

The bug disappears when removing the following fix that was introduced in 348c9c9:

InChI/INCHI-1-SRC/INCHI_BASE/src/mol_fmt3.c

Lines 1497 to 1501 in 8feee9e

	if (num_list) /* djb-rwth: fixing coverity CID #499489 */
	{
	inchi_free(num_list);
	num_list = NULL;
	}

The test output is now:

[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from inchi_dll_b_testing
[ RUN      ] inchi_dll_b_testing.test_MakeINCHIFromMolfileText
/workspaces/InChI/INCHI-1-TEST/tests/test_unit/test_inchi_dll_b.cpp:86: Failure
Death test: MakeINCHIFromMolfileText(ferrocene, options, poutput)
    Result: failed to die.
 Error msg:
[  DEATH   ] 

[  FAILED  ] inchi_dll_b_testing.test_MakeINCHIFromMolfileText (2 ms)
[----------] 1 test from inchi_dll_b_testing (2 ms total)

[----------] Global test environment tear-down
[==========] 1 test from 1 test suite ran. (2 ms total)
[  PASSED  ] 0 tests.
[  FAILED  ] 1 test, listed below:
[  FAILED  ] inchi_dll_b_testing.test_MakeINCHIFromMolfileText

 1 FAILED TEST

@djb-rwth, could you have a look?

[djb-rwth]

According to git bisect the commit that introduces the bug is 348c9c9.

The bug disappears when removing the following fix that was introduced in [348c9c9]

Hi @JanCBrammer,
git bisect was right about this.
It is a false positive by Coverity Scan where it wishes to free memory allocated in MolfileV3000ReadHapticBond although **num_lists returns results from it.

Issue added to Coverity Scan modelling file and fix integrated in PR #180.