Re: segfault in ffi_data_to_code_pointer

[Anthony Green <green@redhat.com>]

Hi DJ,

DJ Delorie <dj@redhat.com> writes:
> In src/closures.c, ffi_data_to_code_pointer() calls segment_holding()
> to get a pointer to the code segment for a data segment.  It doesn't
> check for a NULL return, and I've got a test case where I run Ruby's
> test suite (on a non-selinux aarch64 machine, if that matters) and
> segment_holding() returns NULL and much hilarity ensues.

This suggests that the ffi_closure object used to invoke
ffi_data_to_code_pointer wasn't allocated by ffi_closure_alloc().  Is
that something you can check?

Thanks,

AG

>
> The following patch fixes the segfault, but I don't know if
> segment_holding() returning NULL is an expected case, or a symptom of
> problems elsewhere?
>
>> diff -rup a/src/closures.c b/src/closures.c
>> --- a/src/closures.c	2019-06-25 21:21:06.738743440 -0400
>> +++ b/src/closures.c	2019-06-25 21:22:00.769716129 -0400
>> @@ -621,7 +621,10 @@ void *
>>  ffi_data_to_code_pointer (void *data)
>>  {
>>    msegmentptr seg = segment_holding (gm, data);
>> -  return add_segment_exec_offset (data, seg);
>> +  if (seg)
>> +    return add_segment_exec_offset (data, seg);
>> +  else
>> +    return data;
>>  }

-- 
Anthony Green <green@redhat.com> 
Senior Principal Solutions Architect, Financial Services
+1 647 477-3809