read after free in notmuch new
Tomi Ollila
tomi.ollila at iki.fi
Tue Feb 21 12:25:24 PST 2017
On Tue, Feb 21 2017, David Bremner <david at tethera.net> wrote:
> David Bremner <david at tethera.net> writes:
>
>> David Bremner <david at tethera.net> writes:
>>
>>> I haven't had a chance to really track this down, but it seems there is
>>> a memory error in notmuch new (or a maybe false positive from valgrind).
>>>
>>> Attached is the log from running "make memory-test OPTIONS=--medium" on
>>> current git master (0e037c34).
>>>
>>> It looks like we talloc the message_id string with the message object as
>>> parent, but it somehow outlives the message object.
>>
>> Sorry, that had a few commits beyond master.
>>
>> master (08343d3d) gives essentially the same log.
>>
>
> The log says the relevent piece of memory was freed at line 655 of database.cc, which
> is the g_hash_table_insert in the code
>
> ref = _parse_message_id (ctx, refs, &refs);
>
> if (ref && strcmp (ref, message_id)) {
> g_hash_table_insert (hash, ref, NULL);
> last_ref = ref;
> }
>
>
> According to the docs for g_hash_table_insert
>
> If the key already exists in the GHashTable its current value is
> replaced with the new value. If you supplied a value_destroy_func
> when creating the GHashTable, the old value is freed using that
> function. If you supplied a key_destroy_func when creating the
> GHashTable, the passed key is freed using that function.
>
> Since we do pass a key_destroy_func, it seems we are being naughty by
> returning last_ref just below.
To me it looks like replacing g_hash_table_insert() with
g_hash_table_replace() would do the trick.
(or even g_hash_table_add()!)
One has to read the documentation a bit (and compare the docstrings of
these 2 functions to guess the missing pieces) to get some understanding to
this...
Tomi
More information about the notmuch
mailing list