GNU bug report logs - #12095
Protecting pointer on bytevector with guardian does not protect memory

Previous Next

Full log

View this message in rfc822 format

From: Patrick Bernaud <patrickb <at> chez.com>
To: 12095 <at> debbugs.gnu.org
Subject: bug#12095: Protecting pointer on bytevector with guardian does not protect memory
Date: Mon, 30 Jul 2012 18:01:09 +0200

[Message part 1 (text/plain, inline)]

The memory from a bytevector of which a pointer is taken (with
'bytevector->pointer') can be overwritten even if that pointer has
been put inside a guardian. 'make-c-struct' from (system foreign) is
using 'bytevector->pointer'.

With the test script attached:

$ guile -v | head -1
guile (GNU Guile) 2.0.6.8-cc26b9-dirty
$ guile --no-auto-compile -s test.scm
#<pointer 0x974648c>
#vu8(1 1 1 1 1 1 1 1 1 1)
#vu8(1 1 1 1 1 1 1 1 1 1)
#vu8(110 103 45 108 101 110 103 116 104 0)  <<<< memory overwrite with "ng-length\0" from module
#<pointer 0x974648c>
$

With auto compilation turned on, it looks like the problem can not be
reproduced.

-- 
Patrick Bernaud

[test.scm (application/octet-stream, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.