Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix segfault on VOL termination #100

Merged
merged 2 commits into from
Nov 10, 2023

Conversation

mattjala
Copy link
Collaborator

@mattjala mattjala commented Nov 10, 2023

Sometimes the global type array RV_type_info_array_g can have a NULL value, and if it did, the VOL termination would attempt to dereference a NULL pointer while freeing it. It now checks that the array exists before trying to free it.

I'm not exactly sure what factors cause the array to be NULL - it's declared in rest_vol.h, defined in rest_vol.c, and never explicitly set to NULL. This issue didn't come up with the dynamically linked or manually linked tests on their own - it only cropped up when using the manually linked tests (test_rest_vol) when they were built under the library with fetch content, and when running them through the autotools-generated script.

@mattjala mattjala added bug Something isn't working testing Related to testing process labels Nov 10, 2023
rv_hash_table_free(RV_type_info_array_g[i]->table);
RV_free(RV_type_info_array_g[i]);
RV_type_info_array_g[i] = NULL;
if (RV_type_info_array_g) {
Copy link
Collaborator

@jhendersonHDF jhendersonHDF Nov 10, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's likely the fact that it isn't explicitly initialized to NULL entries, so it ends up trying to free random pointers. The condition here probably doesn't do much since RV_type_info_array_g is an array of pointers. Rather, I think the real fix should be changing RV_type_info *RV_type_info_array_g[H5I_MAX_NUM_TYPES]; to RV_type_info *RV_type_info_array_g[H5I_MAX_NUM_TYPES] = {0}; at the top of this file, while also keeping the added check below of if (RV_type_info_array_g[i]) {.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that freeing a NULL pointer is allowed by the standard, so this is almost certainly due to the array having uninitialized entries that the code is attempting to free.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This particular issue was due to the top level RV_type_info_array_g pointer being NULL when referenced in line 633, so I think we should keep that check around. It's still true that we should avoid passing around uninitialized pointers - I've added the initialization.

@jhendersonHDF
Copy link
Collaborator

jhendersonHDF commented Nov 10, 2023

The failures in the fetchcontent actions can be ignored, as they're a commit behind due to the nature of fetching the current HEAD commit of the upstream repo rather than working from the commit in the PR. We should probably have the fetchcontent actions be a separate daily action, or remove them from this repo's CI testing as I'm testing them elsewhere now and they'll soon be in a daily build in the HDF5 repo.

@jhendersonHDF jhendersonHDF merged commit ecbbb8c into HDFGroup:master Nov 10, 2023
@mattjala mattjala deleted the fix_termination_segfault branch November 13, 2023 15:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working testing Related to testing process
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants