Skip to content

dump: Fix double free in oj_write_obj_to_file #768

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 1, 2022

Conversation

tonobo
Copy link
Contributor

@tonobo tonobo commented Jun 1, 2022

We encountered a segfault by dumping json in certain conditions. There seems to be an obsolete fclose which is likely caused by a merge / rebase fault.

Backtrace:

#0  0x00007f00b459a00b in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007f00b4579859 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007f00b45e426e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007f00b45ec2fc in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x00007f00b45edf6d in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#5  0x00007f00b45d8ec3 in fclose () from /lib/x86_64-linux-gnu/libc.so.6
#6  0x00007f00b001541e in oj_write_obj_to_file (obj=93852459311840, path=<optimized out>, copts=copts@entry=0x7ffd9c5debb0) at dump.c:624
#7  0x00007f00b002c9f6 in to_file (argc=<optimized out>, argv=0x7f00b3ed4ed0, self=<optimized out>) at oj.c:1364
#8  0x00007f00b4957026 in vm_call_cfunc_with_frame (empty_kw_splat=<optimized out>, cd=0x555bbaa578d0, calling=<optimized out>, reg_cfp=0x7f00b3fd2e90, 
    ec=0x555bb87dc600) at vm_insnhelper.c:2514
#9  vm_call_cfunc (ec=0x555bb87dc600, reg_cfp=0x7f00b3fd2e90, calling=<optimized out>, cd=0x555bbaa578d0) at vm_insnhelper.c:2539
#10 0x00007f00b4963dab in vm_call_method (ec=0x555bb87dc600, cfp=0x7f00b3fd2e90, calling=<optimized out>, cd=<optimized out>) at vm_insnhelper.c:3053
#11 0x00007f00b494a406 in vm_sendish (ec=ec@entry=0x555bb87dc600, reg_cfp=reg_cfp@entry=0x7f00b3fd2e90, cd=0x555bbaa578d0, 
    block_handler=block_handler@entry=0, method_explorer=method_explorer@entry=0x7f00b4950d80 <vm_search_method_wrap>) at vm_insnhelper.c:4023
#12 0x00007f00b495b0ba in vm_exec_core (ec=<optimized out>, initial=<optimized out>) at insns.def:801
#13 0x00007f00b4961870 in rb_vm_exec (ec=0x555bb87dc600, mjit_enable_p=1) at vm.c:2090
#14 0x00007f00b4965918 in vm_call0_body (ec=0x555bb87dc600, calling=0x7ffd9c5df1a0, cd=<optimized out>, argv=0x7ffd9c5df370) at vm_eval.c:136
...

Verified

This commit was signed with the committer’s verified signature. The key has expired.
tonobo Tim Foerster
We encountered a segfault by dumping json in certain conditions. There seems to be an obsolete fclose which is likely caused by an merge / rebase fault.

Backtrace:

```gdb
 #0  0x00007f00b459a00b in raise () from /lib/x86_64-linux-gnu/libc.so.6
 ohler55#1  0x00007f00b4579859 in abort () from /lib/x86_64-linux-gnu/libc.so.6
 ohler55#2  0x00007f00b45e426e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
 ohler55#3  0x00007f00b45ec2fc in ?? () from /lib/x86_64-linux-gnu/libc.so.6
 ohler55#4  0x00007f00b45edf6d in ?? () from /lib/x86_64-linux-gnu/libc.so.6
 ohler55#5  0x00007f00b45d8ec3 in fclose () from /lib/x86_64-linux-gnu/libc.so.6
 ohler55#6  0x00007f00b001541e in oj_write_obj_to_file (obj=93852459311840, path=<optimized out>, copts=copts@entry=0x7ffd9c5debb0) at dump.c:624
 ohler55#7  0x00007f00b002c9f6 in to_file (argc=<optimized out>, argv=0x7f00b3ed4ed0, self=<optimized out>) at oj.c:1364
 ohler55#8  0x00007f00b4957026 in vm_call_cfunc_with_frame (empty_kw_splat=<optimized out>, cd=0x555bbaa578d0, calling=<optimized out>, reg_cfp=0x7f00b3fd2e90,
     ec=0x555bb87dc600) at vm_insnhelper.c:2514
 ohler55#9  vm_call_cfunc (ec=0x555bb87dc600, reg_cfp=0x7f00b3fd2e90, calling=<optimized out>, cd=0x555bbaa578d0) at vm_insnhelper.c:2539
 ohler55#10 0x00007f00b4963dab in vm_call_method (ec=0x555bb87dc600, cfp=0x7f00b3fd2e90, calling=<optimized out>, cd=<optimized out>) at vm_insnhelper.c:3053
 ohler55#11 0x00007f00b494a406 in vm_sendish (ec=ec@entry=0x555bb87dc600, reg_cfp=reg_cfp@entry=0x7f00b3fd2e90, cd=0x555bbaa578d0,
     block_handler=block_handler@entry=0, method_explorer=method_explorer@entry=0x7f00b4950d80 <vm_search_method_wrap>) at vm_insnhelper.c:4023
 ohler55#12 0x00007f00b495b0ba in vm_exec_core (ec=<optimized out>, initial=<optimized out>) at insns.def:801
 ohler55#13 0x00007f00b4961870 in rb_vm_exec (ec=0x555bb87dc600, mjit_enable_p=1) at vm.c:2090
 ohler55#14 0x00007f00b4965918 in vm_call0_body (ec=0x555bb87dc600, calling=0x7ffd9c5df1a0, cd=<optimized out>, argv=0x7ffd9c5df370) at vm_eval.c:136
...
```
@tonobo tonobo force-pushed the fix-double-free branch from 010c460 to 6b33d45 Compare June 1, 2022 04:45
@ohler55 ohler55 merged commit 74b4bbf into ohler55:develop Jun 1, 2022
@tonobo
Copy link
Contributor Author

tonobo commented Jun 3, 2022

Can you create a release containing the fix?

@ohler55
Copy link
Owner

ohler55 commented Jun 3, 2022

Released. Sorry for the delay.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants