From: Sean Bradly Date: 2011-02-01T08:59:54+09:00 Subject: [ruby-core:35026] [Backport87-Backport#4339] Segmentation fault during Marshal.load --mimepart_4d474c3db5c2c_59865a406be26cb Content-Type: text/plain Content-Transfer-Encoding: Quoted-printable Content-Disposition: inline Issue #4339 has been updated by Sean Bradly. File ruby-1.8.7-trac22417.patch added Fwiw, this resolves the issue for me. The general problem is that "struct= load_arg arg" is on the stack AND wrapped by an RData. When GC starts, t= he RData refers to arg (a stack pointer) but the current (GC) thread's st= ack has clobbered this address. My fix simply switches arg to be dynamica= lly allocated, and the same for mark_dump_arg. However, it appears this w= ill leak a small amount of memory if Marshal throws an exception. This se= ems ok for my application, so I'm not going to look into it any more. ---------------------------------------- http://redmine.ruby-lang.org/issues/show/4339 ---------------------------------------- http://redmine.ruby-lang.org --mimepart_4d474c3db5c2c_59865a406be26cb Content-Type: text/x-patch; name=ruby-1.8.7-trac22417.patch Content-Transfer-Encoding: Base64 Content-Disposition: attachment; filename=ruby-1.8.7-trac22417.patch LS0tIHJ1YnktMS44Ljctc3RvY2svbWFyc2hhbC5jCTIwMTAtMDYtMjMgMTA6 Mjg6MDQuMDAwMDAwMDAwIC0wNTAwCisrKyBydWJ5LTEuOC43LWJwcy1wMS9t YXJzaGFsLmMJMjAxMS0wMS0zMSAxNjo1NTozNC4wOTY2Njc2NjAgLTA2MDAK QEAgLTcyMyw3ICs3MjMsNiBAQAogICAgIGlmIChhcmctPnRhaW50KSB7CiAJ T0JKX1RBSU5UKGFyZy0+c3RyKTsKICAgICB9Ci0KICAgICByZXR1cm4gMDsK IH0KIApAQCAtNzYwLDkgKzc1OSwxMiBAQAogewogICAgIFZBTFVFIG9iaiwg cG9ydCwgYTEsIGEyOwogICAgIGludCBsaW1pdCA9IC0xOwotICAgIHN0cnVj dCBkdW1wX2FyZyBhcmc7CisgICAgc3RydWN0IGR1bXBfYXJnICphcmcgPSBt YWxsb2Moc2l6ZW9mKHN0cnVjdCBkdW1wX2FyZykpOwogICAgIHN0cnVjdCBk dW1wX2NhbGxfYXJnIGNfYXJnOwogCisgICAgaWYoIWFyZykKKyAgICAgICAg cmJfbWVtZXJyb3IoKTsKKwogICAgIHBvcnQgPSBRbmlsOwogICAgIHJiX3Nj YW5fYXJncyhhcmdjLCBhcmd2LCAiMTIiLCAmb2JqLCAmYTEsICZhMik7CiAg ICAgaWYgKGFyZ2MgPT0gMykgewpAQCAtNzc1LDM4ICs3NzcsMzggQEAKIAll bHNlIGlmIChOSUxfUChhMSkpIGdvdG8gdHlwZV9lcnJvcjsKIAllbHNlIHBv cnQgPSBhMTsKICAgICB9Ci0gICAgYXJnLmRlc3QgPSAwOwotICAgIGFyZy5z eW1ib2xzID0gc3RfaW5pdF9udW10YWJsZSgpOwotICAgIGFyZy5kYXRhICAg ID0gc3RfaW5pdF9udW10YWJsZSgpOwotICAgIGFyZy50YWludCAgID0gUWZh bHNlOwotICAgIGFyZy5zdHIgPSByYl9zdHJfYnVmX25ldygwKTsKLSAgICBS QkFTSUMoYXJnLnN0ciktPmtsYXNzID0gMDsKLSAgICBhcmcud3JhcHBlciA9 IERhdGFfV3JhcF9TdHJ1Y3QocmJfY0RhdGEsIG1hcmtfZHVtcF9hcmcsIDAs ICZhcmcpOworICAgIGFyZy0+ZGVzdCA9IDA7CisgICAgYXJnLT5zeW1ib2xz ID0gc3RfaW5pdF9udW10YWJsZSgpOworICAgIGFyZy0+ZGF0YSAgICA9IHN0 X2luaXRfbnVtdGFibGUoKTsKKyAgICBhcmctPnRhaW50ICAgPSBRZmFsc2U7 CisgICAgYXJnLT5zdHIgPSByYl9zdHJfYnVmX25ldygwKTsKKyAgICBSQkFT SUMoYXJnLT5zdHIpLT5rbGFzcyA9IDA7CisgICAgYXJnLT53cmFwcGVyID0g RGF0YV9XcmFwX1N0cnVjdChyYl9jRGF0YSwgbWFya19kdW1wX2FyZywgMCwg YXJnKTsKICAgICBpZiAoIU5JTF9QKHBvcnQpKSB7CiAJaWYgKCFyYl9yZXNw b25kX3RvKHBvcnQsIHNfd3JpdGUpKSB7CiAJICB0eXBlX2Vycm9yOgogCSAg ICByYl9yYWlzZShyYl9lVHlwZUVycm9yLCAiaW5zdGFuY2Ugb2YgSU8gbmVl ZGVkIik7CiAJfQotCWFyZy5kZXN0ID0gcG9ydDsKKwlhcmctPmRlc3QgPSBw b3J0OwogCWlmIChyYl9yZXNwb25kX3RvKHBvcnQsIHNfYmlubW9kZSkpIHsK IAkgICAgcmJfZnVuY2FsbDIocG9ydCwgc19iaW5tb2RlLCAwLCAwKTsKLQkg ICAgY2hlY2tfZHVtcF9hcmcoJmFyZywgc19iaW5tb2RlKTsKKwkgICAgY2hl Y2tfZHVtcF9hcmcoYXJnLCBzX2Jpbm1vZGUpOwogCX0KICAgICB9CiAgICAg ZWxzZSB7Ci0JcG9ydCA9IGFyZy5zdHI7CisJcG9ydCA9IGFyZy0+c3RyOwog ICAgIH0KIAogICAgIGNfYXJnLm9iaiAgID0gb2JqOwotICAgIGNfYXJnLmFy ZyAgID0gJmFyZzsKKyAgICBjX2FyZy5hcmcgICA9IGFyZzsKICAgICBjX2Fy Zy5saW1pdCA9IGxpbWl0OwogCi0gICAgd19ieXRlKE1BUlNIQUxfTUFKT1Is ICZhcmcpOwotICAgIHdfYnl0ZShNQVJTSEFMX01JTk9SLCAmYXJnKTsKLQot ICAgIHJiX2Vuc3VyZShkdW1wLCAoVkFMVUUpJmNfYXJnLCBkdW1wX2Vuc3Vy ZSwgKFZBTFVFKSZhcmcpOwotICAgIFJCQVNJQyhhcmcuc3RyKS0+a2xhc3Mg PSByYl9jU3RyaW5nOworICAgIHdfYnl0ZShNQVJTSEFMX01BSk9SLCBhcmcp OworICAgIHdfYnl0ZShNQVJTSEFMX01JTk9SLCBhcmcpOwogCisgICAgcmJf ZW5zdXJlKGR1bXAsIChWQUxVRSkmY19hcmcsIGR1bXBfZW5zdXJlLCAoVkFM VUUpYXJnKTsKKyAgICBSQkFTSUMoYXJnLT5zdHIpLT5rbGFzcyA9IHJiX2NT dHJpbmc7CisgICAgZnJlZShhcmcpOwogICAgIHJldHVybiBwb3J0OwogfQog CkBAIC0xNDUzLDcgKzE0NTUsMTAgQEAKICAgICBWQUxVRSBwb3J0LCBwcm9j OwogICAgIGludCBtYWpvciwgbWlub3IsIHRhaW50ID0gUWZhbHNlOwogICAg IFZBTFVFIHY7Ci0gICAgc3RydWN0IGxvYWRfYXJnIGFyZzsKKyAgICBzdHJ1 Y3QgbG9hZF9hcmcgKmFyZyA9IG1hbGxvYyhzaXplb2Yoc3RydWN0IGxvYWRf YXJnKSk7CisKKyAgICBpZighYXJnKQorICAgICAgICByYl9tZW1lcnJvcigp OwogCiAgICAgcmJfc2Nhbl9hcmdzKGFyZ2MsIGFyZ3YsICIxMSIsICZwb3J0 LCAmcHJvYyk7CiAgICAgdiA9IHJiX2NoZWNrX3N0cmluZ190eXBlKHBvcnQp OwpAQCAtMTQ3MCwxNiArMTQ3NSwxNiBAQAogICAgIGVsc2UgewogCXJiX3Jh aXNlKHJiX2VUeXBlRXJyb3IsICJpbnN0YW5jZSBvZiBJTyBuZWVkZWQiKTsK ICAgICB9Ci0gICAgYXJnLnNyYyA9IHBvcnQ7Ci0gICAgYXJnLm9mZnNldCA9 IDA7Ci0gICAgYXJnLnN5bWJvbHMgPSBzdF9pbml0X251bXRhYmxlKCk7Ci0g ICAgYXJnLmRhdGEgICAgPSBzdF9pbml0X251bXRhYmxlKCk7Ci0gICAgYXJn LnByb2MgPSAwOwotICAgIGFyZy53cmFwcGVyID0gRGF0YV9XcmFwX1N0cnVj dChyYl9jRGF0YSwgbWFya19sb2FkX2FyZywgMCwgJmFyZyk7Ci0gICAgYXJn LnRhaW50ID0gdGFpbnQ7CisgICAgYXJnLT5zcmMgPSBwb3J0OworICAgIGFy Zy0+b2Zmc2V0ID0gMDsKKyAgICBhcmctPnN5bWJvbHMgPSBzdF9pbml0X251 bXRhYmxlKCk7CisgICAgYXJnLT5kYXRhICAgID0gc3RfaW5pdF9udW10YWJs ZSgpOworICAgIGFyZy0+cHJvYyA9IDA7CisgICAgYXJnLT53cmFwcGVyID0g RGF0YV9XcmFwX1N0cnVjdChyYl9jRGF0YSwgbWFya19sb2FkX2FyZywgMCwg YXJnKTsKKyAgICBhcmctPnRhaW50ID0gdGFpbnQ7CiAKLSAgICBtYWpvciA9 IHJfYnl0ZSgmYXJnKTsKLSAgICBtaW5vciA9IHJfYnl0ZSgmYXJnKTsKKyAg ICBtYWpvciA9IHJfYnl0ZShhcmcpOworICAgIG1pbm9yID0gcl9ieXRlKGFy Zyk7CiAgICAgaWYgKG1ham9yICE9IE1BUlNIQUxfTUFKT1IgfHwgbWlub3Ig PiBNQVJTSEFMX01JTk9SKSB7CiAJcmJfcmFpc2UocmJfZVR5cGVFcnJvciwg ImluY29tcGF0aWJsZSBtYXJzaGFsIGZpbGUgZm9ybWF0IChjYW4ndCBiZSBy ZWFkKVxuXAogXHRmb3JtYXQgdmVyc2lvbiAlZC4lZCByZXF1aXJlZDsgJWQu JWQgZ2l2ZW4iLApAQCAtMTQ5MSw4ICsxNDk2LDEwIEBACiAJCU1BUlNIQUxf TUFKT1IsIE1BUlNIQUxfTUlOT1IsIG1ham9yLCBtaW5vcik7CiAgICAgfQog Ci0gICAgaWYgKCFOSUxfUChwcm9jKSkgYXJnLnByb2MgPSBwcm9jOwotICAg IHYgPSByYl9lbnN1cmUobG9hZCwgKFZBTFVFKSZhcmcsIGxvYWRfZW5zdXJl LCAoVkFMVUUpJmFyZyk7CisgICAgaWYgKCFOSUxfUChwcm9jKSkgYXJnLT5w cm9jID0gcHJvYzsKKyAgICB2ID0gcmJfZW5zdXJlKGxvYWQsIChWQUxVRSlh cmcsIGxvYWRfZW5zdXJlLCAoVkFMVUUpYXJnKTsKKworICAgIGZyZWUoYXJn KTsKIAogICAgIHJldHVybiB2OwogfQo= --mimepart_4d474c3db5c2c_59865a406be26cb--