Re: BUG: ruby segfault in notmuch_rb_tags_each

[Felipe Contreras <felipe.contreras@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1420 bytes --]

On Sat, Apr 30, 2022 at 5:09 PM arcnmx <arcnmx@gmail.com> wrote:
>
> Hi, I've been running into rare crashes via notmuch-vim for a while now and finally got around to tracking down the problem. I apologize for the size of the reproduction case, but at least it can be reproduced!

Thanks for the reproduction case, I setted up nix and indeed I was
able to reproduce the issue, I narrowed it down to a much simpler
test-case.

The problem is that Notmuch::Tags is mapped to notmuch_tags_t which in
the past was a standalone iterator, but later on could only be used
once, in particular I think this commit broke the assumption of the
Ruby bindings: d19c5de1 (Add the tag list to the unified message
metadata pass., 2010-12-09).

The code of notmuch-vim stores this tags iterable, traverses it, and
then afterwards tries to traverse it again, even after the original
parent (notmuch_message_t) might have been destroyed.

The crash can be reproduced in C with something like:

  tags_0 = notmuch_message_get_tags(message);
  // Store it for later
  tags_1 = notmuch_message_get_tags(message);
  // Traverse it

I've sent the patches that fix this in the Ruby bindings, but in the
meantime you can try this workaround in the Message constructor of
notmuch-vim:

    @tags = msg.tags.map(&:to_s)

I'm attaching a simple script that reproduces the issue.

Cheers.

-- 
Felipe Contreras

[-- Attachment #2: simple.rb --]
[-- Type: application/x-ruby, Size: 329 bytes --]

[-- Attachment #3: Type: text/plain, Size: 0 bytes --]