Re: use after free in python notmuch2 bindings

[David Bremner <david@tethera.net>]

[-- Attachment #1: Type: text/plain, Size: 1992 bytes --]

David Bremner <david@tethera.net> writes:

> I've been attempting to port nmweb to the new bindings, but I got stuck
> on a bug that segfaults python. I attached a reduced version that
> reproduces the problem for me. It uses recent messages from the notmuch
> list; it others can't reproduce let me know and I will try to make
> something more self contained including a message set.
>

Attached is a slightly simpler (and more informative) reproducer

It produces the the following output for me

7f23164b6cd0 <notmuch2.Thread object at 0x7f23164b6cd0>
   87fsqijx7u.fsf@metapensiero.it <cdata 'struct _notmuch_message *' 0x137a000>
     7f23164b6a90 <NotmuchIter>
       87lf0anoiv.fsf@tethera.net <cdata 'struct _notmuch_message *' 0x13636f0>
         7f23164b6910 <NotmuchIter>
           87bl16jezh.fsf@metapensiero.it <cdata 'struct _notmuch_message *' 0x139a6b0>
             7f23164c3070 <NotmuchIter>
           87bl0vlbys.fsf@powell.devork.be <cdata 'struct _notmuch_message *' 0x139b8e0>
             7f23164c30d0 <NotmuchIter>
   87lf0anoiv.fsf@tethera.net <cdata 'struct _notmuch_message *' 0x13636f0>
     7f23164b68e0 <NotmuchIter>
       87bl16jezh.fsf@metapensiero.it <cdata 'struct _notmuch_message *' 0x139a6b0>
         7f23164b6a00 <NotmuchIter>
       87bl0vlbys.fsf@powell.devork.be <cdata 'struct _notmuch_message *' 0x139b8e0>
zsh: IOT instruction  python3 test.py

The IOT instruction is actually talloc aborting. If I leave in the call
to msg.header, it segfaults as before.

I noticed that the message struct 0x139b8e0 is visited twice, once as
part of the thread and once as part of reply-to-reply-to-reply.

I think the issue here is that bindings destroy the iterator for
replies, but the library docs say

"
 * The returned list will be destroyed when the thread is
 * destroyed.
"

Perhaps that needs to be worded more strongly, to forbid the user from
calling notmuch_messages_destroy. I still need to untangle the intended
ownership semantics to be sure.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: test.py --]
[-- Type: text/x-python, Size: 501 bytes --]

from notmuch2 import Database

def show_msgs(msgs, level):
    print('{:s} {:x} {:s}'.format(' ' * level*4, id(msgs), str(msgs)))
    for msg in msgs:
        print('{:s} {:s} {:s}'.format(' ' * (level*4+2), msg.messageid, str(msg._msg_p)))
        replies=msg.replies()
        show_msgs(replies, level+1)
    

db = Database(config=Database.CONFIG.SEARCH)
msg=db.find("87fsqijx7u.fsf@metapensiero.it")
threads = db.threads(query="thread:"+msg.threadid)
thread = next (threads)

show_msgs(thread, 0)

[-- Attachment #3: Type: text/plain, Size: 0 bytes --]