Skip to content

Fix std::bad_alloc - #80

Merged
fmrico merged 1 commit into
rollingfrom
fix_bad_alloc
Aug 15, 2026
Merged

Fix std::bad_alloc#80
fmrico merged 1 commit into
rollingfrom
fix_bad_alloc

Conversation

@fmrico

@fmrico fmrico commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

Hi,

This PR fixes a dangling tf_info reference in async map-topic callbacks. RTTFBuffer::get_tf_info() returns TFInfo by value (a locked snapshot copy). Several on_initialize() methods did:

const auto & tf_info = RTTFBuffer::getInstance()->get_tf_info();  // binds to a temporary
...
incoming_map_sub_ = node->create_subscription<...>(..., [&](...) {
  ... tf_info.map_frame ...   // captured by reference
});

Temporary lifetime extension only keeps the temporary alive until tf_info itself goes out of scope, i.e. until on_initialize() returns. The subscription lambda captures tf_info by reference ([&]) and is invoked later, after that scope has ended, so tf_info is dangling by the time a message arrives. Reading tf_info.map_frame then interprets freed memory as a std::string, producing a garbage size and an operator new call that throws std::bad_alloc.

To fix it, inside each async callback, fetch a fresh snapshot at the point of use (RTTFBuffer::getInstance()->get_tf_info().map_frame) instead of reusing the captured reference. Synchronous uses of tf_info within on_initialize()'s own scope are untouched as those are safe.

This bug affected to :

  • easynav_costmap_maps_managerCostmapMapsManager.cpp
  • easynav_simple_maps_managerSimpleMapsManager.cpp
  • easynav_navmap_maps_managerNavMapMapsManager.cpp (two callbacks: incoming_occ_map, incoming_pc2_map)
  • easynav_octomap_maps_managerOctomapMapsManager.cpp (incoming_pc2_map; also dropped the now-unused outer tf_info local)

Signed-off-by: Francisco Martín Rico <fmrico@gmail.com>
Copilot AI lite review requested due to automatic review settings August 15, 2026 07:20

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a use-after-scope bug in multiple map manager plugins where async subscription callbacks captured a const auto& tf_info bound to a temporary returned by RTTFBuffer::get_tf_info() (by value), leading to dangling std::string reads and std::bad_alloc at runtime.

Changes:

  • Replaced async-callback uses of tf_info.map_frame with fresh per-callback snapshot reads via RTTFBuffer::getInstance()->get_tf_info().map_frame.
  • Removed the now-unused outer tf_info reference in OctomapMapsManager and updated TF lookup / message header assignment accordingly.
  • Kept synchronous (in-scope) uses of tf_info inside on_initialize() unchanged.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
maps_managers/easynav_simple_maps_manager/src/easynav_simple_maps_manager/SimpleMapsManager.cpp Avoids capturing a dangling tf_info in the incoming map subscription callback by fetching map_frame at point of use.
maps_managers/easynav_octomap_maps_manager/src/easynav_octomap_maps_manager/OctomapMapsManager.cpp Removes outer tf_info reference and fetches map_frame inside the PointCloud2 callback for TF lookup and message headers.
maps_managers/easynav_navmap_maps_manager/src/easynav_navmap_maps_manager/NavMapMapsManager.cpp Fixes two async callbacks to use a fresh map_frame snapshot instead of a captured temporary reference.
maps_managers/easynav_costmap_maps_manager/src/easynav_costmap_maps_manager/CostmapMapsManager.cpp Fixes the incoming map subscription callback to read map_frame from a fresh get_tf_info() snapshot.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@fmrico
fmrico merged commit 07758f3 into rolling Aug 15, 2026
2 checks passed
@fmrico
fmrico deleted the fix_bad_alloc branch August 15, 2026 07:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants