bug#12095: Protecting pointer on bytevector with guardian does not protect memory

[Patrick Bernaud <patrickb@chez.com>]

[-- Attachment #1: message body and .signature --]
[-- Type: text/plain, Size: 658 bytes --]


The memory from a bytevector of which a pointer is taken (with
'bytevector->pointer') can be overwritten even if that pointer has
been put inside a guardian. 'make-c-struct' from (system foreign) is
using 'bytevector->pointer'.

With the test script attached:

$ guile -v | head -1
guile (GNU Guile) 2.0.6.8-cc26b9-dirty
$ guile --no-auto-compile -s test.scm
#<pointer 0x974648c>
#vu8(1 1 1 1 1 1 1 1 1 1)
#vu8(1 1 1 1 1 1 1 1 1 1)
#vu8(110 103 45 108 101 110 103 116 104 0)  <<<< memory overwrite with "ng-length\0" from module
#<pointer 0x974648c>
$

With auto compilation turned on, it looks like the problem can not be
reproduced.

-- 
Patrick Bernaud


[-- Attachment #2: test.scm --]
[-- Type: application/octet-stream, Size: 526 bytes --]

(use-modules (system foreign) (rnrs bytevectors))
(define my-guardian (make-guardian))
(define len 10)
(define x (bytevector->pointer (make-bytevector len 1)))
(define a (pointer-address x))
(display x)(newline)
(my-guardian x)
;(my-guardian (pointer->bytevector x len))
(set! x #f)
(write (pointer->bytevector (make-pointer a) len))(newline)
(gc)
(write (pointer->bytevector (make-pointer a) len))(newline)
(use-modules (htmlprag))
(write (pointer->bytevector (make-pointer a) len))(newline)
(display (my-guardian))(newline)