[Tcl-bugs] [ tcl-Bugs-484200 ] TclEvalObjvInternal: potential segfault

[<no...@so...>]

Bugs item #484200, was opened at 2001-11-21 15:11
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=484200&group_id=10894

Category: 43. Parsing and Eval
Group: 8.4a4
>Status: Closed
>Resolution: Invalid
Priority: 9
Submitted By: Don Porter (dgp)
Assigned to: Vince Darley (vincentdarley)
Summary: TclEvalObjvInternal: potential segfault

Initial Comment:

Within TclEvalObjvInternal(), trace
procedures are called in a loop like:

for (tracePtr = iPtr->tracePtr;
     tracePtr != NULL;
     tracePtr = nextPtr) {
  nextPtr = tracePtr->nextPtr;
  ...
  (*tracePtr->proc)(tracePtr->clientData, interp,
                    iPtr->numLevels, commandCopy,
                    cmdPtr->proc, cmdPtr->clientData,
                    objc, argv);
}

Trouble with that is (*tracePtr->proc) could
do anything, including calling Tcl_DeleteTrace
on the Tcl_Trace held by nextPtr.  If it does
that, there will be a segfault.

The technique used by command and variable traces
that involves defining additional structures
such as ActiveCommandTrace and special handling
could be adapted to solve this problem.

----------------------------------------------------------------------

>Comment By: Vince Darley (vincentdarley)
Date: 2002-06-26 15:26

Message:
Logged In: YES 
user_id=32170

I agree with Miguel.  It looks as if there is not a 
problem.  I also recall doing extensive testing of this 
sort of thing (trace deletes trace, trace deletes cmd, etc), 
with no adverse effects.


----------------------------------------------------------------------

Comment By: miguel sofer (msofer)
Date: 2002-06-21 18:40

Message:
Logged In: YES 
user_id=148712

It looks like it did; that logic now moved from TEOVI to
TclCheck[...]Traces in tclCmdMZ.c, a cursory look (without
deep understanding) suggests the issue is handled there.

Assigning to Vince so that he (hopefully) confirms that
all's well and closes the ticket.

----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2002-06-21 17:05

Message:
Logged In: YES 
user_id=80530


Can we check that TIP 62 really fixed this?

----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2001-11-26 20:57

Message:
Logged In: YES 
user_id=80530

The TIP 62 reference implementation
(Tcl Patch 562580) appears to address
this potential bug, though it's a
patch against an earlier HEAD.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=484200&group_id=10894