[Bug] Netweaver RFC 7.50 PL7 crashes on Linux in RfcLogFile::openTrace during SAP_DllMainInit

[former_member690718]

We have upgraded our C++ client using NW RFC 7.50 from PL3 to PL7. Now we experience crashes on .so initialization with the following call stack:

*** Error in `saptest': munmap_chunk(): invalid pointer: 0x00000000025fe000 ***
#0  0x00007fffeded42c7 in raise () from /lib64/libc.so.6
#1  0x00007fffeded59b8 in abort () from /lib64/libc.so.6
#2  0x00007fffedf16e17 in __libc_message () from /lib64/libc.so.6
#3  0x00007fffedf1d754 in malloc_printerr () from /lib64/libc.so.6
#4  0x00007ffff07de99e in RfcLogFile::openTrace() () from /opt/3rdparty.8.4.0/bin/libsapnwrfc.so
#5  0x00007ffff078f368 in RfcLogWrite(RfcConnection*, _STL::basic_string<char16_t, _STL::char_traits<char16_t>, _STL::allocator<char16_t> > const&, char16_t const*, __va_list_tag*) () from /opt/3rdparty.8.4.0/bin/libsapnwrfc.so
#6  0x00007ffff078f6e9 in RfcLogError(char16_t const*, ...) () from /opt/3rdparty.8.4.0/bin/libsapnwrfc.so
#7  0x00007ffff0a1b22e in RfcInit () from /opt/3rdparty.8.4.0/bin/libsapnwrfc.so
#8  0x00007ffff09de3a8 in SAP_DllMainInit () from /opt/3rdparty.8.4.0/bin/libsapnwrfc.so
#9  0x00007ffff7dea8f3 in _dl_init_internal () from /lib64/ld-linux-x86-64.so.2
#10 0x00007ffff7ddc15a in _dl_start_user () from /lib64/ld-linux-x86-64.so.2

Analysis with Valgrind (valgrind --leak-check=full --track-origins=yes) shows varying invalid reads/writes and finally the following exception:

==31133== Process terminating with default action of signal 11 (SIGSEGV)
==31133==  Access not within mapped region at address 0x58
==31133==    at 0xBCB0296: _STL::_Filebuf_base::_M_open(char const*, int, long) (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0xBAE23D3: _STL::basic_ofstream<char16_t, _STL::char_traits<char16_t> >::open(char const*, int) (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0xBAE17A5: AbstractRfcTraceFile::openWithCodec(_STL::basic_string<char16_t, _STL::char_traits<char16_t>, _STL::allocator<char16_t> >) (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0xBAE19EF: RfcLogFile::openTrace() (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0xBA92367: RfcLogWrite(RfcConnection*, _STL::basic_string<char16_t, _STL::char_traits<char16_t>, _STL::allocator<char16_t> > const&, char16_t const*, __va_list_tag*) (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0xBA926E8: RfcLogError(char16_t const*, ...) (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0xBD1E22D: RfcInit (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0xBCE13A7: SAP_DllMainInit (in /opt/3rdparty.8.4.0/bin/libsapnwrfc.so)
==31133==    by 0x400F8F2: _dl_init (in /usr/lib64/ld-2.17.so)
==31133==    by 0x4001159: ??? (in /usr/lib64/ld-2.17.so)

This happened on a RHEL7 system. Tests on a RHEL8 system did not crash immediately. But running the program under Valgrind provokes the crash and shows the same exception. RFC_TRACE_DIR has to be set for the crash to occur. The message that is written before the crash is:

2020-11-23 15:36:42.580104 [140647311747008] >> Info entry
        Did not find config file /opt/euplfsv8/sapnwrfc.ini.<br>

We could reproduce the problem even with an executable with an empty main() linked against libsapnwrfc.so. A short test of PL6 shows no problems. Valgrind logs of PL3 and PL6 show no invalid reads/writes.

Has anyone else experienced this problem?