Subject: bug#12095: closed (Re: bug#12095: Protecting pointer on bytevector with guardian does not protect memory)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 08 Oct 2012 15:44:02 +0000

Your bug report

#12095: Protecting pointer on bytevector with guardian does not protect memory

which was filed against the guile package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
12095: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12095
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#12095: Protecting pointer on bytevector with guardian does not protect memory
From: [email-masked] (Ludovic Courtès)
To: Daniel Hartwig <[email-masked]>
Cc: Patrick Bernaud <[email-masked]>, [email-masked], Ian Price <[email-masked]>
Date: Mon, 08 Oct 2012 17:42:49 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Daniel Hartwig <[email-masked]> skribis:

> On 8 October 2012 21:44, Ludovic Courtès <[email-masked]> wrote:
>>> On 8 October 2012 04:38, Ludovic Courtès <[email-masked]> wrote:
>>> Right.  But then the pointer is being collected even though it remains
>>> inside the guardian, in the example it is never extracted from there.
>>
>> Well, when the object reaches the guardian’s zombie list, that’s because
>> it’s been finalized, so any weak references from that object can also be
>> nullified.
>
> Ah.  So I thought that being in the zombie list prevented any
> finalization, thus when the guardian returns an object it is still
> fully functional and only after the reference is lost again does it
> really get finalized.

Well, the object is still usable when the guardian returns it, because
it’s been kept alive by the finalizer (‘finalize_guarded’ in
guardians.c).

Now, whether weak references from the object are subject to
“nullification” by the GC is clearly a gray area, but I’m not surprised
that it is.

>> How does it help?  Should we close the bug?  :-)
>
> Sure.  At least you seem convinced and you has actually hacked on it :-)

Good.  :-)

So closing it now, but feel free to reopen if you think something’s wrong.

Thanks,
Ludo’.

Subject: Protecting pointer on bytevector with guardian does not protect memory
From: Patrick Bernaud <[email-masked]>
To: [email-masked]
Date: Mon, 30 Jul 2012 18:01:09 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

The memory from a bytevector of which a pointer is taken (with
'bytevector->pointer') can be overwritten even if that pointer has
been put inside a guardian. 'make-c-struct' from (system foreign) is
using 'bytevector->pointer'.

With the test script attached:

$ guile -v | head -1
guile (GNU Guile) 2.0.6.8-cc26b9-dirty
$ guile --no-auto-compile -s test.scm
#<pointer 0x974648c>
#vu8(1 1 1 1 1 1 1 1 1 1)
#vu8(1 1 1 1 1 1 1 1 1 1)
#vu8(110 103 45 108 101 110 103 116 104 0)  <<<< memory overwrite with "ng-length\0" from module
#<pointer 0x974648c>
$

With auto compilation turned on, it looks like the problem can not be
reproduced.

-- 
Patrick Bernaud