[Tcl-bugs] [ tcl-Bugs-1884496 ] read from freed memory

[SourceForge.net <no...@so...>]

Bugs item #1884496, was opened at 2008-02-01 07:26
Message generated for change (Comment added) made by dgp
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1884496&group_id=10894

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 45. Parsing and Eval
Group: None
Status: Open
Resolution: None
Priority: 7
Private: No
Submitted By: Don Porter (dgp)
Assigned to: Don Porter (dgp)
Summary: read from freed memory

Initial Comment:

Only on the dgp-refactor branch:

Following script reads from freed
memory (MEM_DEBUG build to verify):

set script {set a [p]; puts "result is $a"}
proc p {} {string first l $::script}
eval $script

Need some way to protect tokens getting
freed in the middle of evaluation.

----------------------------------------------------------------------

>Comment By: Don Porter (dgp)
Date: 2013-01-10 08:42

Message:

I see test execute-11.1 panic .  Another symptom?

----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2013-01-10 07:59

Message:

The vulnerable point is 
TclNREvalObjEx() with the TCL_EVAL_DIRECT
flag set.  [eval] no longer goes there.

----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2013-01-10 07:14

Message:

This demo script stopped crashing with the checkin

  http://core.tcl.tk/tcl/info/815028bdfc

This is when the NRE-enabled [eval]
command was merged in.

I think the change stopped this particular
demo script from crashing, but didn't really
address the underlying lack of lifetime management.
Would need another demo to continue pursuing that.

----------------------------------------------------------------------

Comment By: Alexandre Ferrieux (ferrieux)
Date: 2013-01-09 15:30

Message:
Tested today, --enable-symbols=all or mem, with or without valgrind, cannot
seem to repro.

Can you ?

----------------------------------------------------------------------

Comment By: Alexandre Ferrieux (ferrieux)
Date: 2011-09-23 15:17

Message:
Is that still valid with all your valgrinding experience ? ;-) 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1884496&group_id=10894