Process should not crash.
==560519==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000420f8 at pc 0x7fba662a4f45 bp 0x7fba5cfbe0b0 sp 0x7fba5cfbe0a8
READ of size 8 at 0x6020000420f8 thread T10
#0 0x7fba662a4f44 in enqueue(map_t*, int, int, int, int, std::priority_queue<CellData, std::vector<CellData, std::allocator<CellData> >, std::less<CellData> >&, CachedDistanceMap*, unsigned char*) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/map/map_cspace.cpp:102:21
#1 0x7fba662a669f in map_update_cspace /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/map/map_cspace.cpp:155:7
#2 0x7fba662b7525 in nav2_amcl::LikelihoodFieldModel::LikelihoodFieldModel(double, double, double, double, unsigned long, map_t*) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/sensors/laser/likelihood_field_model.cpp:38:3
#3 0x7fba669a5aa5 in nav2_amcl::AmclNode::createLaserObject() /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/amcl_node.cpp:1051:14
#4 0x7fba66998cf5 in nav2_amcl::AmclNode::addNewScanner(int&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, geometry_msgs::msg::PoseStamped_<std::allocator<void> >&) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/amcl_node.cpp:749:21
#5 0x7fba66995106 in nav2_amcl::AmclNode::laserReceived(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/amcl_node.cpp:649:10
#6 0x7fba66b03bae in void std::__invoke_impl<void, void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>(std::__invoke_memfun_deref, void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
#7 0x7fba66b0383a in std::__invoke_result<void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>::type std::__invoke<void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>(void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#8 0x7fba66b036e7 in void std::_Bind<void (nav2_amcl::AmclNode::* (nav2_amcl::AmclNode*, std::_Placeholder<1>))(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)>::__call<void, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, 0ul, 1ul>(std::tuple<std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>&&, std::_Index_tuple<0ul, 1ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:400:11
#9 0x7fba66b034f2 in void std::_Bind<void (nav2_amcl::AmclNode::* (nav2_amcl::AmclNode*, std::_Placeholder<1>))(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)>::operator()<std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, void>(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:482:17
#10 0x7fba66b02e4d in std::_Function_handler<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&), std::_Bind<void (nav2_amcl::AmclNode::* (nav2_amcl::AmclNode*, std::_Placeholder<1>))(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)> >::_M_invoke(std::_Any_data const&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
#11 0x7fba66b01ffd in std::function<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&)>::operator()(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
#12 0x7fba66b0190d in std::_Function_handler<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), std::function<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&)> >::_M_invoke(std::_Any_data const&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
#13 0x7fba66ac3465 in std::function<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)>::operator()(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
#14 0x7fba66b02524 in message_filters::CallbackHelper1T<std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, sensor_msgs::msg::LaserScan_<std::allocator<void> > >::call(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, bool) /opt/ros/foxy/include/message_filters/signal1.h:74:5
#15 0x7fba66a7e8a5 in message_filters::Signal1<sensor_msgs::msg::LaserScan_<std::allocator<void> > >::call(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /opt/ros/foxy/include/message_filters/signal1.h:117:15
#16 0x7fba66a7e588 in message_filters::SimpleFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> > >::signalMessage(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /opt/ros/foxy/include/message_filters/simple_filter.h:133:13
#17 0x7fba66af9785 in tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::messageReady(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /opt/ros/foxy/include/tf2_ros/message_filter.h:643:13
#18 0x7fba66aee19b in tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::transformReadyCallback(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long) /opt/ros/foxy/include/tf2_ros/message_filter.h:537:7
#19 0x7fba66afd3d2 in void std::__invoke_impl<void, void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&>(std::__invoke_memfun_deref, void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
#20 0x7fba66afd077 in std::__invoke_result<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&>::type std::__invoke<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&>(void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#21 0x7fba66afceee in void std::_Bind<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::* (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*, std::_Placeholder<1>, unsigned long))(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long)>::__call<void, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, 0ul, 1ul, 2ul>(std::tuple<std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:400:11
#22 0x7fba66afcc62 in void std::_Bind<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::* (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*, std::_Placeholder<1>, unsigned long))(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long)>::operator()<std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, void>(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:482:17
#23 0x7fba66afc2cd in std::_Function_handler<void (std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&), std::_Bind<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::* (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*, std::_Placeholder<1>, unsigned long))(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long)> >::_M_invoke(std::_Any_data const&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
#24 0x7fba671c92e7 in std::function<void (std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&)>::operator()(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&) const /usr/include/c++/9/bits/std_function.h:688:14
#25 0x7fba671c92e7 in operator() obj-x86_64-linux-gnu/./src/buffer.cpp:263:15
#26 0x7fba671c92e7 in _M_invoke /usr/include/c++/9/bits/std_function.h:300:37
#27 0x7fba67149330 in std::function<void (unsigned long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::chrono::time_point<std::chrono::_V2::system_clock, std::chrono::duration<long, std::ratio<1l, 1000000000l> > >, tf2::TransformableResult)>::operator()(unsigned long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::chrono::time_point<std::chrono::_V2::system_clock, std::chrono::duration<long, std::ratio<1l, 1000000000l> > >, tf2::TransformableResult) const /usr/include/c++/9/bits/std_function.h:688:14
#28 0x7fba67149330 in tf2::BufferCore::testTransformableRequests() obj-x86_64-linux-gnu/./src/buffer_core.cpp:1493:13
#29 0x7fba6714abc3 in tf2::BufferCore::setTransformImpl(tf2::Transform const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::chrono::time_point<std::chrono::_V2::system_clock, std::chrono::duration<long, std::ratio<1l, 1000000000l> > >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) obj-x86_64-linux-gnu/./src/buffer_core.cpp:337:28
#30 0x7fba6714c5fc in tf2::BufferCore::setTransform(geometry_msgs::msg::TransformStamped_<std::allocator<void> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) obj-x86_64-linux-gnu/./src/buffer_core.cpp:234:26
#31 0x7fba671d0695 in tf2_ros::TransformListener::subscription_callback(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool) obj-x86_64-linux-gnu/./src/transform_listener.cpp:102:27
#32 0x7fba671d801c in void std::__invoke_impl<void, void (tf2_ros::TransformListener::*&)(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool), tf2_ros::TransformListener*&, std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool&>(std::__invoke_memfun_deref, void (tf2_ros::TransformListener::*&)(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool), tf2_ros::TransformListener*&, std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >&&, bool&) /usr/include/c++/9/bits/invoke.h:73:46
#33 0x7fba671d801c in std::__invoke_result<void (tf2_ros::TransformListener::*&)(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool), tf2_ros::TransformListener*&, std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool&>::type std::__invoke<void (tf2_ros::TransformListener::*&)(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool), tf2_ros::TransformListener*&, std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool&>(void (tf2_ros::TransformListener::*&)(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool), tf2_ros::TransformListener*&, std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >&&, bool&) /usr/include/c++/9/bits/invoke.h:95:40
#34 0x7fba671d801c in void std::_Bind<void (tf2_ros::TransformListener::* (tf2_ros::TransformListener*, std::_Placeholder<1>, bool))(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool)>::__call<void, std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >&&, 0ul, 1ul, 2ul>(std::tuple<std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) /usr/include/c++/9/functional:400:24
#35 0x7fba671d801c in void std::_Bind<void (tf2_ros::TransformListener::* (tf2_ros::TransformListener*, std::_Placeholder<1>, bool))(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool)>::operator()<std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, void>(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >&&) /usr/include/c++/9/functional:484:24
#36 0x7fba671d801c in std::_Function_handler<void (std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >), std::_Bind<void (tf2_ros::TransformListener::* (tf2_ros::TransformListener*, std::_Placeholder<1>, bool))(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, bool)> >::_M_invoke(std::_Any_data const&, std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >&&) /usr/include/c++/9/bits/std_function.h:300:37
#37 0x7fba671e4660 in std::function<void (std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >)>::operator()(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >) const /usr/include/c++/9/bits/std_function.h:688:14
#38 0x7fba671e4660 in rclcpp::AnySubscriptionCallback<tf2_msgs::msg::TFMessage_<std::allocator<void> >, std::allocator<void> >::dispatch(std::shared_ptr<tf2_msgs::msg::TFMessage_<std::allocator<void> > >, rclcpp::MessageInfo const&) /opt/ros/foxy/include/rclcpp/any_subscription_callback.hpp:163:7
#39 0x7fba671e4ece in rclcpp::Subscription<tf2_msgs::msg::TFMessage_<std::allocator<void> >, std::allocator<void>, rclcpp::message_memory_strategy::MessageMemoryStrategy<tf2_msgs::msg::TFMessage_<std::allocator<void> >, std::allocator<void> > >::handle_message(std::shared_ptr<void>&, rclcpp::MessageInfo const&) /opt/ros/foxy/include/rclcpp/subscription.hpp:275:5
#40 0x7fba66fc002b (/opt/ros/foxy/lib/librclcpp.so+0xd702b)
#41 0x7fba66fc08ea in rclcpp::Executor::execute_subscription(std::shared_ptr<rclcpp::SubscriptionBase>) (/opt/ros/foxy/lib/librclcpp.so+0xd78ea)
#42 0x7fba66fc10a4 in rclcpp::Executor::execute_any_executable(rclcpp::AnyExecutable&) (/opt/ros/foxy/lib/librclcpp.so+0xd80a4)
#43 0x7fba66fc5a4b in rclcpp::executors::SingleThreadedExecutor::spin() (/opt/ros/foxy/lib/librclcpp.so+0xdca4b)
#44 0x7fba671d08e1 in operator() obj-x86_64-linux-gnu/./src/transform_listener.cpp:79:21
#45 0x7fba671d08e1 in __invoke_impl<void, tf2_ros::TransformListener::initThread(rclcpp::node_interfaces::NodeBaseInterface::SharedPtr)::<lambda(rclcpp::node_interfaces::NodeBaseInterface::SharedPtr)>, std::shared_ptr<rclcpp::node_interfaces::NodeBaseInterface> > /usr/include/c++/9/bits/invoke.h:60:36
#46 0x7fba671d08e1 in __invoke<tf2_ros::TransformListener::initThread(rclcpp::node_interfaces::NodeBaseInterface::SharedPtr)::<lambda(rclcpp::node_interfaces::NodeBaseInterface::SharedPtr)>, std::shared_ptr<rclcpp::node_interfaces::NodeBaseInterface> > /usr/include/c++/9/bits/invoke.h:95:40
#47 0x7fba671d08e1 in _M_invoke<0, 1> /usr/include/c++/9/thread:244:26
#48 0x7fba671d08e1 in operator() /usr/include/c++/9/thread:251:31
#49 0x7fba671d08e1 in _M_run /usr/include/c++/9/thread:195:13
#50 0x7fba66178de3 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd6de3)
#51 0x7fba66e96608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
#52 0x7fba65e5b292 in clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
0x6020000420f8 is located 0 bytes to the right of 8-byte region [0x6020000420f0,0x6020000420f8)
allocated by thread T10 here:
#0 0x4c664d in operator new[](unsigned long) (/home/r1/ros2_nav_fuzz/build/nav2_amcl/amcl+0x4c664d)
#1 0x7fba662a75ad in CachedDistanceMap::CachedDistanceMap(double, double) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/map/map_cspace.cpp:43:18
#2 0x7fba662a4b58 in get_distance_map(double, double) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/map/map_cspace.cpp:83:15
#3 0x7fba662a59df in map_update_cspace /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/map/map_cspace.cpp:133:29
#4 0x7fba662b7525 in nav2_amcl::LikelihoodFieldModel::LikelihoodFieldModel(double, double, double, double, unsigned long, map_t*) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/sensors/laser/likelihood_field_model.cpp:38:3
#5 0x7fba669a5aa5 in nav2_amcl::AmclNode::createLaserObject() /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/amcl_node.cpp:1051:14
#6 0x7fba66998cf5 in nav2_amcl::AmclNode::addNewScanner(int&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, geometry_msgs::msg::PoseStamped_<std::allocator<void> >&) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/amcl_node.cpp:749:21
#7 0x7fba66995106 in nav2_amcl::AmclNode::laserReceived(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>) /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/amcl_node.cpp:649:10
#8 0x7fba66b03bae in void std::__invoke_impl<void, void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>(std::__invoke_memfun_deref, void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
#9 0x7fba66b0383a in std::__invoke_result<void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>::type std::__invoke<void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>(void (nav2_amcl::AmclNode::*&)(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), nav2_amcl::AmclNode*&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#10 0x7fba66b036e7 in void std::_Bind<void (nav2_amcl::AmclNode::* (nav2_amcl::AmclNode*, std::_Placeholder<1>))(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)>::__call<void, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, 0ul, 1ul>(std::tuple<std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&>&&, std::_Index_tuple<0ul, 1ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:400:11
#11 0x7fba66b034f2 in void std::_Bind<void (nav2_amcl::AmclNode::* (nav2_amcl::AmclNode*, std::_Placeholder<1>))(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)>::operator()<std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, void>(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:482:17
#12 0x7fba66b02e4d in std::_Function_handler<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&), std::_Bind<void (nav2_amcl::AmclNode::* (nav2_amcl::AmclNode*, std::_Placeholder<1>))(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)> >::_M_invoke(std::_Any_data const&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
#13 0x7fba66b01ffd in std::function<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&)>::operator()(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
#14 0x7fba66b0190d in std::_Function_handler<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>), std::function<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&)> >::_M_invoke(std::_Any_data const&, std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
#15 0x7fba66ac3465 in std::function<void (std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>)>::operator()(std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
#16 0x7fba66b02524 in message_filters::CallbackHelper1T<std::shared_ptr<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, sensor_msgs::msg::LaserScan_<std::allocator<void> > >::call(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&, bool) /opt/ros/foxy/include/message_filters/signal1.h:74:5
#17 0x7fba66a7e8a5 in message_filters::Signal1<sensor_msgs::msg::LaserScan_<std::allocator<void> > >::call(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /opt/ros/foxy/include/message_filters/signal1.h:117:15
#18 0x7fba66a7e588 in message_filters::SimpleFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> > >::signalMessage(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /opt/ros/foxy/include/message_filters/simple_filter.h:133:13
#19 0x7fba66af9785 in tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::messageReady(message_filters::MessageEvent<sensor_msgs::msg::LaserScan_<std::allocator<void> > const> const&) /opt/ros/foxy/include/tf2_ros/message_filter.h:643:13
#20 0x7fba66aee19b in tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::transformReadyCallback(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long) /opt/ros/foxy/include/tf2_ros/message_filter.h:537:7
#21 0x7fba66afd3d2 in void std::__invoke_impl<void, void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&>(std::__invoke_memfun_deref, void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
#22 0x7fba66afd077 in std::__invoke_result<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&>::type std::__invoke<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&>(void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::*&)(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long), tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#23 0x7fba66afceee in void std::_Bind<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::* (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*, std::_Placeholder<1>, unsigned long))(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long)>::__call<void, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, 0ul, 1ul, 2ul>(std::tuple<std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:400:11
#24 0x7fba66afcc62 in void std::_Bind<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::* (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*, std::_Placeholder<1>, unsigned long))(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long)>::operator()<std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, void>(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:482:17
#25 0x7fba66afc2cd in std::_Function_handler<void (std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&), std::_Bind<void (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>::* (tf2_ros::MessageFilter<sensor_msgs::msg::LaserScan_<std::allocator<void> >, tf2_ros::Buffer>*, std::_Placeholder<1>, unsigned long))(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&, unsigned long)> >::_M_invoke(std::_Any_data const&, std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
#26 0x7fba671c92e7 in std::function<void (std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&)>::operator()(std::shared_future<geometry_msgs::msg::TransformStamped_<std::allocator<void> > > const&) const /usr/include/c++/9/bits/std_function.h:688:14
#27 0x7fba671c92e7 in operator() obj-x86_64-linux-gnu/./src/buffer.cpp:263:15
#28 0x7fba671c92e7 in _M_invoke /usr/include/c++/9/bits/std_function.h:300:37
Thread T10 created by T0 here:
#0 0x481b7a in pthread_create (/home/r1/ros2_nav_fuzz/build/nav2_amcl/amcl+0x481b7a)
#1 0x7fba661790a8 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd70a8)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/r1/ros2_nav_fuzz/src/navigation2/nav2_amcl/src/map/map_cspace.cpp:102:21 in enqueue(map_t*, int, int, int, int, std::priority_queue<CellData, std::vector<CellData, std::allocator<CellData> >, std::less<CellData> >&, CachedDistanceMap*, unsigned char*)
Shadow bytes around the buggy address:
0x0c04800003c0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c04800003d0: fa fa fd fa fa fa fd fd fa fa 00 fa fa fa 00 fa
0x0c04800003e0: fa fa fd fa fa fa fd fa fa fa 00 fa fa fa fd fd
0x0c04800003f0: fa fa fd fd fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x0c0480000400: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
=>0x0c0480000410: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00[fa]
0x0c0480000420: fa fa 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0480000430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0480000440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0480000450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0480000460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==560519==ABORTING
I'll also explore the root cause of this, just report the event first.
Bug report
Required Info:
Steps to reproduce issue
just like the issue #3231 ,except for the configall.yaml:
Expected behavior
Process should not crash.
Actual behavior
the program crashed with the Asan information below:
I'll also explore the root cause of this, just report the event first.