Re: [ ruby-Bugs-3399 ] [PATCH] OS X core dumps when $0 is changed and then loads shared libraries

H.Yamamoto wrote:
> Hello.
> 
> 
>>The problem is that Ruby is setting argv[1..argc-1] to 0 and OS X's dyld
>>expects those to not be 0 as it uses them.  Postgres had the same problem
>>and describes why dyld uses argv:
>>
>>http://archives.postgresql.org/pgsql-hackers/2003-11/msg00449.php
> 
> 
> Interesting, but Starndard C gurantees argc and argv should be modifiable,
> so I think this is OSX's bug.

Agreed that OS X should be able to handle this.  But it appears that even after 
you change argc and argv in the process, you can get the original values back 
with these calls:

extern char ***_NSGetArgv(void);
extern int *_NSGetArgc(void);
extern char ***_NSGetEnviron(void);

which dyld is presumably doing.

Since argc is passed in to main() and you can't change argc in main() for other 
parts of the OS to see, then this breaks the schematics of argv.

>>It's not clear to me why in one branch of the function at the end,
>>origargv[1..argc-1] are set to 0 and in the other they are not.  Just out
>>of consistently, it seems better to have both treat origargv[1..argc-1] the
>>same and not set them to 0, which also prevents this core dump.
>>
>>Here's the patch:
>>
>>diff -ru ruby-1.8.4.orig/ruby.c ruby-1.8.4/ruby.c
>>--- ruby-1.8.4.orig/ruby.c      2005-12-11 16:36:52.000000000 -0800
>>+++ ruby-1.8.4/ruby.c   2006-01-31 22:13:18.000000000 -0800
>>@@ -1067,8 +1067,6 @@
>>       *s++ = '\0';
>>       while (++i < len)
>>           *s++ = ' ';
>>-       for (i = 1; i < origargc; i++)
>>-           origargv[i] = 0;
>>    }
>>    rb_progname = rb_tainted_str_new2(origargv[0]);
>>#endif
> 
> 
> If this patch is applied, for example after set_arg0
> origargv[i] (i >= 1) can point to the location which is filled with ' ',
> and can be unterminated with '\0' like this
> 
>   "fooboofoo\0                   ?"
>                    ^
>                    origargv[1]
> 
>   if '?' != '\0', strlen(origargv[i]) will access out of memory block
> 
> 
> How about this? This is shorter, probably safer.

Looks good.  I've attached another patch based off your patch which does to 
following:

1) Repoints any origargv[] that now point into the new $0 string to the \0 
terminating $0.  This will prevent any problems of command line arguments seeing 
parts of $0.

2) In the if (len == 0) statement, rename 'i' and 's' to 'j' and 's1' to prevent 
shadowing of the same variable names at the top of the function.  This is a 
style matter.

3) Changed a tab into 4 spaces to fix indentation.

Regards,
Blair

-- 
Blair Zajac, Ph.D.
CTO, OrcaWare Technologies
<[e-mail]>
Subversion training, consulting and support
http://www.orcaware.com/svn/