Ticket #630 (closed bug: fixed)

Opened 6 years ago

Last modified 3 years ago

src/dynext.c uses STRING's ->strstart

Reported by: coke Owned by: nwellnhof
Priority: normal Milestone:
Component: core Version: 1.1.0
Severity: medium Keywords:
Cc: Language:
Patch status: Platform:

Description

There are several places in src/dynext.c where, instead of using Parrot_str_to_cstring, it unsafely uses strstart.

Change History

  Changed 6 years ago by NotFound

Fixed several in r38494 The remaining are Windows specific and I don't have a Windows box to test.

  Changed 6 years ago by doughera

Thanks.

There are still a number of places elsewhere that use Parrot_string_cstring, which is simply implemented as return str->strstart . Some of those are wrapped in a strdup() call, and could probably be replaced by calls to more appropriate functions in string/api.c.

Also, this call in src/pmc/packfile.pmc (lines 175-6):

const opcode_t  *ptr =
                (const opcode_t*)Parrot_string_cstring(interp, str);

ends up not only peeking inside the str structure, but also relying on the hidden assumption that the strstart member of the STRING structure happens to be suitably aligned for use as an opcode_t pointer. Slight changes to the STRING structure, such as might occur if UnionVal is removed from it, will invalidate that assumption.

follow-up: ↓ 5   Changed 4 years ago by nwellnhof

  • owner set to nwellnhof

  Changed 4 years ago by nwellnhof

  • status changed from new to assigned

in reply to: ↑ 3   Changed 3 years ago by jkeenan

Replying to nwellnhof:

nwellnhof,

Can we get an update on the status of this ticket?

Thank you very much.

kid51

  Changed 3 years ago by jkeenan

  • component changed from none to core

  Changed 3 years ago by nwellnhof

  • status changed from assigned to closed
  • resolution set to fixed

I fixed the remaining places in the Windows code in commit 67bc4de8872ccb. strstart is still accessed directly in function clone_string_into. This is related to threading and I don't want to touch that code. I think this bug can be closed regardless.

Note: See TracTickets for help on using tickets.