From: Tanaka Akira <akr@...>
Date: 2007-12-25T14:59:26+09:00
Subject: [ruby-dev:32746] appendline Invalid read of size 1

以下のように、appendline がバッファを越えたところで
onigenc_get_left_adjust_char_head を呼び出しているのが観察さ
れます。

% valgrind ./ruby -ve '
open("zz", "wb") {|f|
  f << ("a"*8191+"\n")
}
open("zz", "r:utf-8") {|f|
  p f.gets.squeeze
}
'
==31497== Memcheck, a memory error detector.
==31497== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==31497== Using LibVEX rev 1658, a library for dynamic binary translation.
==31497== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==31497== Using valgrind-3.2.1-Debian, a dynamic binary instrumentation framework.
==31497== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==31497== For more details, rerun with: -v
==31497== 
ruby 1.9.0 (2007-12-25 revision 0) [i686-linux]
==31497== Invalid read of size 1
==31497==    at 0x810E3C0: utf8_left_adjust_char_head (utf8.c:476)
==31497==    by 0x80B57A0: onigenc_get_left_adjust_char_head (regenc.c:363)
==31497==    by 0x806C33B: appendline (io.c:1691)
==31497==    by 0x806C6A9: rb_io_getline_fast (io.c:1784)
==31497==    by 0x806C9B7: rb_io_getline_1 (io.c:1863)
==31497==    by 0x806CCB4: rb_io_getline (io.c:1922)
==31497==    by 0x806CD1F: rb_io_gets_m (io.c:1961)
==31497==    by 0x80FCFBA: call_cfunc (vm_insnhelper.c:281)
==31497==    by 0x810499F: vm_call_cfunc (vm_insnhelper.c:371)
==31497==    by 0x810450C: vm_call_method (vm_insnhelper.c:503)
==31497==    by 0x8100CC6: vm_eval (insns.def:1050)
==31497==    by 0x8104B78: vm_eval_body (vm.c:1148)
==31497==  Address 0x45AC740 is 0 bytes after a block of size 8,192 alloc'd
==31497==    at 0x401D38B: malloc (vg_replace_malloc.c:149)
==31497==    by 0x8061FBD: ruby_xmalloc (gc.c:249)
==31497==    by 0x8062055: ruby_xmalloc2 (gc.c:269)
==31497==    by 0x806B358: io_fillbuf (io.c:989)
==31497==    by 0x806C5E0: appendline (io.c:1736)
==31497==    by 0x806C6A9: rb_io_getline_fast (io.c:1784)
==31497==    by 0x806C9B7: rb_io_getline_1 (io.c:1863)
==31497==    by 0x806CCB4: rb_io_getline (io.c:1922)
==31497==    by 0x806CD1F: rb_io_gets_m (io.c:1961)
==31497==    by 0x80FCFBA: call_cfunc (vm_insnhelper.c:281)
==31497==    by 0x810499F: vm_call_cfunc (vm_insnhelper.c:371)
==31497==    by 0x810450C: vm_call_method (vm_insnhelper.c:503)
"a\n"
==31497== 
==31497== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 21 from 1)
==31497== malloc/free: in use at exit: 991,997 bytes in 7,718 blocks.
==31497== malloc/free: 8,604 allocs, 886 frees, 1,151,047 bytes allocated.
==31497== For counts of detected errors, rerun with: -v
==31497== searching for pointers to 7,718 not-freed blocks.
==31497== checked 797,992 bytes.
==31497== 
==31497== LEAK SUMMARY:
==31497==    definitely lost: 0 bytes in 0 blocks.
==31497==      possibly lost: 68 bytes in 1 blocks.
==31497==    still reachable: 991,929 bytes in 7,717 blocks.
==31497==         suppressed: 0 bytes in 0 blocks.
==31497== Reachable blocks (those to which a pointer was found) are not shown.
==31497== To see them, rerun with: --show-reachable=yes
-- 
[田中 哲][たなか あきら][Tanaka Akira]