Subject: bug#13074: closed (Re: bug#13074: VM Segfaults with Bad `Call' Instruction)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 11 Dec 2012 09:43:02 +0000

Your bug report

#13074: VM Segfaults with Bad `Call' Instruction

which was filed against the guile package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
13074: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=13074
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#13074: VM Segfaults with Bad `Call' Instruction
From: [email-masked] (Ludovic Courtès)
To: Noah Lavine <[email-masked]>
Cc: [email-masked]
Date: Tue, 11 Dec 2012 10:42:09 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi!

Noah Lavine <[email-masked]> skribis:

> In general, I do think there should at least be an option for having full
> error-checking in the VM. It would have been much, much harder for me to
> find this without having patched the VM, because it would have taken me a
> very long time to try each new thing I tried, because I would have had to
> restart Guile. I am happy for it not to be on the regular code-path,
> though. I also realize that writing a compiler is an unusual application,
> so maybe it should even be a compile-time option for users who prefer their
> Guile slow. How does that sound?

The VM does full error checking.  But there’s a difference between
checking whether an object has the expected type, and checking whether
an object is a well-formed ‘SCM’ object (and NULL is not a valid ‘SCM’
object.)

Guile never does the latter, and as a rule of thumb I would keep things
this way.

The brave hacker working on a compiler can easily figure out what how to
debug all sorts of crazy things.  :-)

So I’m closing it for now.

Thanks,
Ludo’.

PS: It’s still unclear to me how you ended up forging an invalid SCM
    object.  I think you either have to generate invalid bytecode, or to
    use (pointer->scm %null-pointer), or variants thereof.

Subject: VM Segfaults with Bad `Call' Instruction
From: Noah Lavine <[email-masked]>
To: [email-masked]
Date: Mon, 3 Dec 2012 22:06:28 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

This is an interesting bug, because the only way to hit it (as far as I can
tell) is to mess up when writing a compiler. However, I did mess up, and I
discover that I can generate a `call' instruction in the trunk VM where the
procedure to call will be 0x0. Then the VM will try to check whether the
procedure is really a procedure, and Guile will segfault at line 796 of
v-i-system.c.

I think the correct behavior would be to throw a `vm-bad-instruction' error
instead. The fix should be pretty simple - just check if program is 0x0 and
jump to vm-bad-instruction in that case.

Noah