From: Ralf Junker <ralfjunker@...>
Date: 2009-08-15T17:42:32+09:00
Subject: [ruby-core:24929] Re: regparse.c - patch to fix memory leak

At 01:48 15.08.2009, Nobuyoshi Nakada wrote:

>> There are several memory leaks in regparse.c. They all relate
>> to incomplete pattern branches, where a branch node is not
>> freed when branch parsing is aborted. I discovered this by
>> successively shortening all patterns in my test suite (which
>> is not in Ruby, nor in C, unfortunately) down to zero length.
>
>What patterns have you found?

Lots of patterns. I started off with the original Oniguruma 5.9.1 tests, namely testc.c and testu.c. Then I modified the suite so that it passes all substrings of the patterns to the engine. Example:

Original pattern:

  (?:a*|b*)(?:a*|b*)

Substrings of original pattern, shortened from end:

  (?:a*|b*)(?:a*|b*
  (?:a*|b*)(?:a*|b
  (?:a*|b*)(?:a*|
  ... until ...
  (

Now shorten from beginning, then from end:

  ?:a*|b*)(?:a*|b*)
  ?:a*|b*)(?:a*|b*
  ?:a*|b*)(?:a*|b
  ... until ....
  ?

and so on, until all substrings are iterated.

>/[b-a]/ causes ONIGERR_EMPTY_CHAR_CLASS but doesn't seem cause
>memory leak.

I can confirm your findings with my patched version.

>> Below is a patch against rev. 24387 which adresses all leaks
>> uncovered and also improves code indentation in a few place.
>
>I wonder if it might introduce double-free instead.  I hope I'm
>wrong.

The memory manager I am using checks for double-frees and actually encountered a few of them when I worked on the problem. Fortunately, I was able to work it out and no double-frees are detected in my modified code.

Ralf