unofficial mirror of notmuch@notmuchmail.org
 help / color / mirror / code / Atom feed
From: Tomi Ollila <tomi.ollila@iki.fi>
To: David Bremner <david@tethera.net>, notmuch@notmuchmail.org
Subject: Re: read after free in notmuch new
Date: Tue, 21 Feb 2017 22:25:24 +0200	[thread overview]
Message-ID: <m2tw7ne1fv.fsf@guru.guru-group.fi> (raw)
In-Reply-To: <87d1ec5ki4.fsf@tethera.net>

On Tue, Feb 21 2017, David Bremner <david@tethera.net> wrote:

> David Bremner <david@tethera.net> writes:
>
>> David Bremner <david@tethera.net> writes:
>>
>>> I haven't had a chance to really track this down, but it seems there is
>>> a memory error in notmuch new (or a maybe false positive from valgrind).
>>>
>>> Attached is the log from running "make memory-test OPTIONS=--medium" on
>>> current git master (0e037c34).
>>>
>>> It looks like we talloc the message_id string with the message object as
>>> parent, but it somehow outlives the message object.
>>
>> Sorry, that had a few commits beyond master.
>>
>> master (08343d3d) gives essentially the same log.
>>
>
> The log says the relevent piece of memory was freed at line 655 of database.cc, which
> is the g_hash_table_insert in the code 
>
> 	ref = _parse_message_id (ctx, refs, &refs);
>
> 	if (ref && strcmp (ref, message_id)) {
> 	    g_hash_table_insert (hash, ref, NULL);
> 	    last_ref = ref;
> 	}
>
>
> According to the docs for g_hash_table_insert
>
>    If the key already exists in the GHashTable its current value is
>    replaced with the new value. If you supplied a value_destroy_func
>    when creating the GHashTable, the old value is freed using that
>    function. If you supplied a key_destroy_func when creating the
>    GHashTable, the passed key is freed using that function.
>
> Since we do pass a key_destroy_func, it seems we are being naughty by
> returning last_ref just below.

To me it looks like replacing g_hash_table_insert() with 
g_hash_table_replace() would do the trick.

(or even g_hash_table_add()!)

One has to read the documentation a bit (and compare the docstrings of
these 2 functions to guess the missing pieces) to get some understanding to
this...

Tomi

  reply	other threads:[~2017-02-21 20:26 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-02-19 14:15 read after free in notmuch new David Bremner
2017-02-19 15:29 ` David Bremner
2017-02-21  2:46   ` David Bremner
2017-02-21 20:25     ` Tomi Ollila [this message]
2017-02-22  1:05       ` David Bremner
2017-02-22  1:44         ` David Bremner
2017-02-22 10:32           ` [PATCH] lib: fix g_hash_table related read-after-free bug David Bremner
2017-02-22 11:25             ` Tomi Ollila
2017-02-23 13:12             ` David Bremner
2017-03-01  1:49   ` read after free in notmuch new David Bremner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://notmuchmail.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=m2tw7ne1fv.fsf@guru.guru-group.fi \
    --to=tomi.ollila@iki.fi \
    --cc=david@tethera.net \
    --cc=notmuch@notmuchmail.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://yhetil.org/notmuch.git/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).