Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix segfault on VOL termination #100

Merged
merged 2 commits into from
Nov 10, 2023
Merged

Fix segfault on VOL termination #100

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36423cb
Fix segfault on VOL termination
mattjala Nov 10, 2023
5562e97
Initialize global type array ptr to NULL
mattjala Nov 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions src/rest_vol.c
View file
Original file line number Diff line number Diff line change
@@ -99,7 +99,7 @@ typedef struct H5_rest_ad_info_t {
} H5_rest_ad_info_t;

/* Global array containing information about open objects */
RV_type_info *RV_type_info_array_g[H5I_MAX_NUM_TYPES];
RV_type_info *RV_type_info_array_g[H5I_MAX_NUM_TYPES] = {0};

/* Host header string for specifying the host (Domain) for requests */
const char *const host_string = "X-Hdf-domain: ";
@@ -629,11 +629,16 @@ H5_rest_term(void)
} /* end if */

/* Cleanup type info array */
for (size_t i = 0; i < H5I_MAX_NUM_TYPES; i++) {
rv_hash_table_free(RV_type_info_array_g[i]->table);
RV_free(RV_type_info_array_g[i]);
RV_type_info_array_g[i] = NULL;
if (RV_type_info_array_g) {
Copy link
Collaborator

@jhendersonHDF jhendersonHDF Nov 10, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's likely the fact that it isn't explicitly initialized to NULL entries, so it ends up trying to free random pointers. The condition here probably doesn't do much since RV_type_info_array_g is an array of pointers. Rather, I think the real fix should be changing RV_type_info *RV_type_info_array_g[H5I_MAX_NUM_TYPES]; to RV_type_info *RV_type_info_array_g[H5I_MAX_NUM_TYPES] = {0}; at the top of this file, while also keeping the added check below of if (RV_type_info_array_g[i]) {.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that freeing a NULL pointer is allowed by the standard, so this is almost certainly due to the array having uninitialized entries that the code is attempting to free.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This particular issue was due to the top level RV_type_info_array_g pointer being NULL when referenced in line 633, so I think we should keep that check around. It's still true that we should avoid passing around uninitialized pointers - I've added the initialization.

for (size_t i = 0; i < H5I_MAX_NUM_TYPES; i++) {
if (RV_type_info_array_g[i]) {
rv_hash_table_free(RV_type_info_array_g[i]->table);
RV_free(RV_type_info_array_g[i]);
RV_type_info_array_g[i] = NULL;
}
}
}

/*
* "Forget" connector ID. This should normally be called by the library
* when it is closing the id, so no need to close it here.