Open
Description
hi, I ran into a segfault with the following code:
mpack_writer_t writer;
char *output_data = nullptr;
size_t output_size = 0;
mpack_writer_init_growable(&writer, &output_data, &output_size);
const int N_OUTER = 10;
const int N_INNER = 100;
mpack_start_array(&writer, N_OUTER);
for (int k=0; k<N_OUTER; k++) {
mpack_build_map(&writer);
mpack_write_str(&writer, "key", 3);
mpack_write_u64(&writer, k*k);
mpack_write_str(&writer, "value", 5);
mpack_start_array(&writer, N_INNER);
for (int i=0; i<N_INNER; i++) {
mpack_build_map(&writer);
mpack_write_str(&writer, "value0", 6);
mpack_write_i64(&writer, i);
mpack_write_str(&writer, "value1", 6);
mpack_write_i64(&writer, i*k);
mpack_complete_map(&writer);
}
mpack_finish_array(&writer);
mpack_complete_map(&writer); // <- segfault here
}
mpack_finish_array(&writer);
mpack_writer_destroy(&writer);At the end of the 5th outer loop, the call to mpack_complete_map() will corrupt the internal memory of the builder, resulting in a segfault. Some mild debugging traced the issue back to the page allocation mechanism. According to the logs, we might be freeing one page and using the next without initializing it.
The problem vanishes when writing different integer values. It seems to be triggered only by very specific alignment conditions.
I would appreciate it ,if you could confirm the findings or give me a clue of any mismatching calls in my code. Thanks!