Valgrind: "Invalid read" with c_str and strtod

Question

im using strtod() to convert some inputstrings. while checking my code with valgrind, i came accross a "invalid read of size 8". the message shows up if b starts with "i" or "n", thats what i discovered so far. also, if i create a const char* directly (without calling c_str()), strtod seems to do fine. heres the code:

#include <cstdlib>
#include <string>

int main(int argc, char** argv) {
      char*       a = 0; 
      std::string b = "i";
      const char* c = b.c_str();
      double      d = strtod(c, &a); 
}

and the (verbose) valgrind output:

==12638== Memcheck, a memory error detector
==12638== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==12638== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==12638== Command: ./leak
==12638== 
--12638-- Valgrind options:
--12638--    --suppressions=/usr/lib/valgrind/debian-libc6-dbg.supp
--12638--    --show-reachable=yes
--12638--    --leak-check=full
--12638--    -v
--12638-- Contents of /proc/version:
--12638--   Linux version 3.2.0-24-generic (buildd@yellow) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) ) #37-Ubuntu SMP Wed Apr 25 08:43:22 UTC 2012
--12638-- Arch and hwcaps: AMD64, amd64-sse3-cx16
--12638-- Page sizes: currently 4096, max supported 4096
--12638-- Valgrind library directory: /usr/lib/valgrind
--12638-- Reading syms from /media/userdata/NetBeansProjects/leak/dist/Debug/GNU-Linux-x86/leak (0x400000)
--12638-- Reading syms from /lib/x86_64-linux-gnu/ld-2.15.so (0x4000000)
--12638--   Considering /lib/x86_64-linux-gnu/ld-2.15.so ..
--12638--   .. CRC mismatch (computed c5d70380 wanted 7d4a76d0)
--12638--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/ld-2.15.so ..
--12638--   .. CRC is valid
--12638-- Reading syms from /usr/lib/valgrind/memcheck-amd64-linux (0x38000000)
--12638--   Considering /usr/lib/valgrind/memcheck-amd64-linux ..
--12638--   .. CRC mismatch (computed b9a585cc wanted 749d1a67)
--12638--    object doesn't have a symbol table
--12638--    object doesn't have a dynamic symbol table
--12638-- Reading suppressions file: /usr/lib/valgrind/debian-libc6-dbg.supp
--12638-- Reading suppressions file: /usr/lib/valgrind/default.supp
==12638== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-12638-by-chri-on-???
==12638== embedded gdbserver: writing to   /tmp/vgdb-pipe-to-vgdb-from-12638-by-chri-on-???
==12638== embedded gdbserver: shared mem   /tmp/vgdb-pipe-shared-mem-vgdb-12638-by-chri-on-???
==12638== 
==12638== TO CONTROL THIS PROCESS USING vgdb (which you probably
==12638== don't want to do, unless you know exactly what you're doing,
==12638== or are doing some strange experiment):
==12638==   /usr/lib/valgrind/../../bin/vgdb --pid=12638 ...command...
==12638== 
==12638== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==12638==   /path/to/gdb ./leak
==12638== and then give GDB the following command
==12638==   target remote | /usr/lib/valgrind/../../bin/vgdb --pid=12638
==12638== --pid is optional if only one valgrind process is running
==12638== 
--12638-- REDIR: 0x40189e0 (strlen) redirected to 0x380625c7 (???)
--12638-- Reading syms from /usr/lib/valgrind/vgpreload_core-amd64-linux.so (0x4a25000)
--12638--   Considering /usr/lib/valgrind/vgpreload_core-amd64-linux.so ..
--12638--   .. CRC mismatch (computed c82927cb wanted 1861273b)
--12638--    object doesn't have a symbol table
--12638-- Reading syms from /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so (0x4c27000)
--12638--   Considering /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so ..
--12638--   .. CRC mismatch (computed 72e29ec9 wanted f3ad49da)
--12638--    object doesn't have a symbol table
--12638-- REDIR: 0x4018850 (index) redirected to 0x4c2bc60 (index)
--12638-- REDIR: 0x40188d0 (strcmp) redirected to 0x4c2cc20 (strcmp)
--12638-- Reading syms from /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16 (0x4e32000)
--12638--   Considering /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16 ..
--12638--   .. CRC mismatch (computed ef748751 wanted e44c0328)
--12638--    object doesn't have a symbol table
--12638-- Reading syms from /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x5132000)
--12638--   Considering /lib/x86_64-linux-gnu/libgcc_s.so.1 ..
--12638--   .. CRC mismatch (computed c8e4b229 wanted 098e39f6)
--12638--    object doesn't have a symbol table
--12638-- Reading syms from /lib/x86_64-linux-gnu/libc-2.15.so (0x5348000)
--12638--   Considering /lib/x86_64-linux-gnu/libc-2.15.so ..
--12638--   .. CRC mismatch (computed 0dfc7f92 wanted 306696b6)
--12638--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.15.so ..
--12638--   .. CRC is valid
--12638-- Reading syms from /lib/x86_64-linux-gnu/libm-2.15.so (0x5705000)
--12638--   Considering /lib/x86_64-linux-gnu/libm-2.15.so ..
--12638--   .. CRC mismatch (computed 84e90409 wanted 8a8fcc58)
--12638--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/libm-2.15.so ..
--12638--   .. CRC is valid
--12638-- REDIR: 0x53d48c0 (strcasecmp) redirected to 0x4a25610 (_vgnU_ifunc_wrapper)
--12638-- REDIR: 0x53d0c60 (strnlen) redirected to 0x4a25610 (_vgnU_ifunc_wrapper)
--12638-- REDIR: 0x53d6b90 (strncasecmp) redirected to 0x4a25610 (_vgnU_ifunc_wrapper)
--12638-- REDIR: 0x53d2650 (__GI_strrchr) redirected to 0x4c2ba80 (__GI_strrchr)
--12638-- REDIR: 0x53d0b30 (strlen) redirected to 0x4a25610 (_vgnU_ifunc_wrapper)
--12638-- REDIR: 0x54a93d0 (__strlen_sse2_pminub) redirected to 0x4c2bfa0 (strlen)
--12638-- REDIR: 0x4ee7dd0 (operator new(unsigned long)) redirected to 0x4c2b160 (operator new(unsigned long))
--12638-- REDIR: 0x53d0b80 (__GI_strlen) redirected to 0x4c2bfc0 (__GI_strlen)
==12638== Invalid read of size 8
==12638==    at 0x53D6C4F: __GI___strncasecmp_l (strcmp.S:213)
==12638==    by 0x538900A: ____strtod_l_internal (strtod_l.c:566)
==12638==    by 0x40088B: main (main.cpp:9)
==12638==  Address 0x59ff058 is 24 bytes inside a block of size 26 alloc'd
==12638==    at 0x4C2B1C7: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12638==    by 0x4ED0A88: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED2494: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED25E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x40085C: main (main.cpp:7)
==12638== 
==12638== Invalid read of size 8
==12638==    at 0x53D6C57: __GI___strncasecmp_l (strcmp.S:215)
==12638==    by 0x538900A: ____strtod_l_internal (strtod_l.c:566)
==12638==    by 0x40088B: main (main.cpp:9)
==12638==  Address 0x59ff060 is 6 bytes after a block of size 26 alloc'd
==12638==    at 0x4C2B1C7: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12638==    by 0x4ED0A88: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED2494: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED25E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x40085C: main (main.cpp:7)
==12638== 
--12638-- REDIR: 0x4ee6150 (operator delete(void*)) redirected to 0x4c2a450 (operator delete(void*))
--12638-- REDIR: 0x53cb010 (free) redirected to 0x4c2a7c0 (free)
==12638== 
==12638== HEAP SUMMARY:
==12638==     in use at exit: 0 bytes in 0 blocks
==12638==   total heap usage: 1 allocs, 1 frees, 26 bytes allocated
==12638== 
==12638== All heap blocks were freed -- no leaks are possible
==12638== 
==12638== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 2 from 2)
==12638== 
==12638== 1 errors in context 1 of 2:
==12638== Invalid read of size 8
==12638==    at 0x53D6C57: __GI___strncasecmp_l (strcmp.S:215)
==12638==    by 0x538900A: ____strtod_l_internal (strtod_l.c:566)
==12638==    by 0x40088B: main (main.cpp:9)
==12638==  Address 0x59ff060 is 6 bytes after a block of size 26 alloc'd
==12638==    at 0x4C2B1C7: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12638==    by 0x4ED0A88: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED2494: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED25E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x40085C: main (main.cpp:7)
==12638== 
==12638== 
==12638== 1 errors in context 2 of 2:
==12638== Invalid read of size 8
==12638==    at 0x53D6C4F: __GI___strncasecmp_l (strcmp.S:213)
==12638==    by 0x538900A: ____strtod_l_internal (strtod_l.c:566)
==12638==    by 0x40088B: main (main.cpp:9)
==12638==  Address 0x59ff058 is 24 bytes inside a block of size 26 alloc'd
==12638==    at 0x4C2B1C7: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12638==    by 0x4ED0A88: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED2494: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x4ED25E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==12638==    by 0x40085C: main (main.cpp:7)
==12638== 
--12638-- 
--12638-- used_suppression:      2 dl-hack3-cond-1
==12638== 
==12638== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 2 from 2)

is there a bug or am i missing something?

Answer 1

I don't think there's a bug in your code. I think this is a bug in Valgrind.

Valgrind has its own implementations of functions like strchr, strcasecmp, etc., which it redirects your application to use instead of the versions in libgcc. A comment in Valgrind's mc_replace_strmem.c file explains:

/* ---------------------------------------------------------------------
   We have our own versions of these functions for two reasons:
   (a) it allows us to do overlap checking
   (b) some of the normal versions are hyper-optimised, which fools
       Memcheck and cause spurious value warnings.  Our versions are
       simpler.

   Note that overenthusiastic use of PLT bypassing by the glibc people also
   means that we need to patch multiple versions of some of the functions to
   our own implementations.

   THEY RUN ON THE SIMD CPU!
   ------------------------------------------------------------------ */

You can see these redirections occurring in the REDIR output from your log.

From examination of mc_replace_strmem.c it looks like Valgrind does not replace __GI___strncasecmp_l, which your log indicates is being called. I'd suggest filing a bug against Valgrind and including your program as a test case.