Skip to content

fix: free retrieval hint with libc free, not deallocShared (SIGSEGV)#87

Open
Ivansete-status wants to merge 1 commit into
masterfrom
fix/retrieval-hint-free
Open

fix: free retrieval hint with libc free, not deallocShared (SIGSEGV)#87
Ivansete-status wants to merge 1 commit into
masterfrom
fix/retrieval-hint-free

Conversation

@Ivansete-status

Copy link
Copy Markdown
Collaborator

Crash

A SIGSEGV surfaced in CI (status-go PR-7378):

wrapOutgoingMessage -> getRecentHistoryEntries -> onRetrievalHint (libsds.nim)
  -> dealloc -> rawDealloc -> deallocBigChunk -> avltree.del
SIGSEGV: Illegal storage access. (Attempt to read from nil?)

Root cause

The retrieval-hint provider (the Go binding's C.CBytes) allocates the returned hint with malloc and hands ownership to us. The hand-written hint closure freed it with deallocShared — i.e. through Nim's shared-heap allocator, not libc free. Freeing a malloc'd pointer through Nim's allocator corrupts that allocator's metadata, so a later allocation crashes in deallocBigChunk/avltree.del. Once wrapOutgoingMessage starts invoking the provider per causal-history entry, this triggers reliably.

The hint provider is hand-written (a raw C function pointer has no JSON form for nim-ffi to marshal), so this free is nim-sds's responsibility.

Fix

Free the malloc'd buffer with libc free.

Verification

Reproduced end-to-end via the C ABI on the release/v0.3 line (a malloc-based provider + 500 SdsWrapOutgoingMessage calls, ~4900 provider invocations): the buggy build segfaults (exit 139), the fixed build completes cleanly. Same one-line allocator fix applies here. nim check passes.

Companion fixes: nim-sds v0.3.3 (release/v0.3) and PR #86 (release/v0.4) carry the identical fix.

🤖 Generated with Claude Code

The retrieval-hint provider (the Go binding's C.CBytes) allocates the
returned hint with malloc and hands us ownership. The hand-written hint
closure freed it with Nim's deallocShared, corrupting Nim's shared-heap
allocator and crashing with a SIGSEGV in deallocBigChunk/avltree.del once
wrapOutgoingMessage starts invoking the provider per causal-history entry.
Free it with libc free instead.

The hint provider is hand-written (a C function pointer has no JSON form
for nim-ffi to marshal), so this free is nim-sds's responsibility on every
line. Reproduced end-to-end via the C ABI on release/v0.3: buggy build
segfaults (exit 139), fixed build completes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant