fix: free retrieval hint with libc free, not deallocShared (SIGSEGV)#87
Open
Ivansete-status wants to merge 1 commit into
Open
fix: free retrieval hint with libc free, not deallocShared (SIGSEGV)#87Ivansete-status wants to merge 1 commit into
Ivansete-status wants to merge 1 commit into
Conversation
The retrieval-hint provider (the Go binding's C.CBytes) allocates the returned hint with malloc and hands us ownership. The hand-written hint closure freed it with Nim's deallocShared, corrupting Nim's shared-heap allocator and crashing with a SIGSEGV in deallocBigChunk/avltree.del once wrapOutgoingMessage starts invoking the provider per causal-history entry. Free it with libc free instead. The hint provider is hand-written (a C function pointer has no JSON form for nim-ffi to marshal), so this free is nim-sds's responsibility on every line. Reproduced end-to-end via the C ABI on release/v0.3: buggy build segfaults (exit 139), fixed build completes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Crash
A SIGSEGV surfaced in CI (status-go PR-7378):
Root cause
The retrieval-hint provider (the Go binding's
C.CBytes) allocates the returnedhintwith malloc and hands ownership to us. The hand-written hint closure freed it withdeallocShared— i.e. through Nim's shared-heap allocator, not libcfree. Freeing a malloc'd pointer through Nim's allocator corrupts that allocator's metadata, so a later allocation crashes indeallocBigChunk/avltree.del. OncewrapOutgoingMessagestarts invoking the provider per causal-history entry, this triggers reliably.The hint provider is hand-written (a raw C function pointer has no JSON form for nim-ffi to marshal), so this free is nim-sds's responsibility.
Fix
Free the malloc'd buffer with libc
free.Verification
Reproduced end-to-end via the C ABI on the release/v0.3 line (a malloc-based provider + 500
SdsWrapOutgoingMessagecalls, ~4900 provider invocations): the buggy build segfaults (exit 139), the fixed build completes cleanly. Same one-line allocator fix applies here.nim checkpasses.Companion fixes: nim-sds
v0.3.3(release/v0.3) and PR #86 (release/v0.4) carry the identical fix.🤖 Generated with Claude Code