From: David Bremner <david@tethera.net>
To: notmuch@notmuchmail.org
Subject: Re: read after free in notmuch new
Date: Mon, 20 Feb 2017 22:46:11 -0400 [thread overview]
Message-ID: <87d1ec5ki4.fsf@tethera.net> (raw)
In-Reply-To: <87bmty6vwu.fsf@tethera.net>
David Bremner <david@tethera.net> writes:
> David Bremner <david@tethera.net> writes:
>
>> I haven't had a chance to really track this down, but it seems there is
>> a memory error in notmuch new (or a maybe false positive from valgrind).
>>
>> Attached is the log from running "make memory-test OPTIONS=--medium" on
>> current git master (0e037c34).
>>
>> It looks like we talloc the message_id string with the message object as
>> parent, but it somehow outlives the message object.
>
> Sorry, that had a few commits beyond master.
>
> master (08343d3d) gives essentially the same log.
>
The log says the relevent piece of memory was freed at line 655 of database.cc, which
is the g_hash_table_insert in the code
ref = _parse_message_id (ctx, refs, &refs);
if (ref && strcmp (ref, message_id)) {
g_hash_table_insert (hash, ref, NULL);
last_ref = ref;
}
According to the docs for g_hash_table_insert
If the key already exists in the GHashTable its current value is
replaced with the new value. If you supplied a value_destroy_func
when creating the GHashTable, the old value is freed using that
function. If you supplied a key_destroy_func when creating the
GHashTable, the passed key is freed using that function.
Since we do pass a key_destroy_func, it seems we are being naughty by
returning last_ref just below.
I'm not sure about the best solution; one option would be to drop the
key_destroy_func and manually talloc_free ref, something like
char *ref=NULL;
while (*refs) {
if (ref) talloc_free (ref);
ref = _parse_message_id (ctx, refs, &refs);
if (ref && strcmp (ref, message_id)) {
g_hash_table_insert (hash, ref, NULL);
last_ref = ref;
}
}
next prev parent reply other threads:[~2017-02-21 2:46 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-19 14:15 read after free in notmuch new David Bremner
2017-02-19 15:29 ` David Bremner
2017-02-21 2:46 ` David Bremner [this message]
2017-02-21 20:25 ` Tomi Ollila
2017-02-22 1:05 ` David Bremner
2017-02-22 1:44 ` David Bremner
2017-02-22 10:32 ` [PATCH] lib: fix g_hash_table related read-after-free bug David Bremner
2017-02-22 11:25 ` Tomi Ollila
2017-02-23 13:12 ` David Bremner
2017-03-01 1:49 ` read after free in notmuch new David Bremner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://notmuchmail.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87d1ec5ki4.fsf@tethera.net \
--to=david@tethera.net \
--cc=notmuch@notmuchmail.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).