Skip to content

Commit 6ab6c29

Browse files
committed
Remove multiple calls to free when successively calling jq_reset.
`jq_reset` calls `jv_free` on the `exit_code` and the `error_message` stored on the jq state. However, it doesn't replace the actual instance of those members. This means that subsequent calls to `jq_reset` will call `jv_free` again on those members, which in turn may call `free` on the same pointer multiple times. Freeing the same pointer multiple times is undefined behavior and can cause heap corruption, which is how I spotted this issue. In practice, this issue only occurs when using a program that may `halt_error`, because that is when the `exit_code` and `error_message` are set to values other than `jv_invalid`. Subsequent attempts to call `jq_start` (which calls `jq_reset` internally) after hitting a `halt_error` can cause you to run into this issue. The changes simply reset the `exit_code` and the `error_message` to `jv_invalid` (the initial value set in `jq_init`) after they are freed.
1 parent 250475b commit 6ab6c29

File tree

2 files changed

+64
-0
lines changed

2 files changed

+64
-0
lines changed

src/execute.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,9 @@ static void jq_reset(jq_state *jq) {
315315

316316
jq->halted = 0;
317317
jv_free(jq->exit_code);
318+
jq->exit_code = jv_invalid();
318319
jv_free(jq->error_message);
320+
jq->error_message = jv_invalid();
319321
if (jv_get_kind(jq->path) != JV_KIND_INVALID)
320322
jv_free(jq->path);
321323
jq->path = jv_null();

src/jq_test.c

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
static void jv_test();
1212
static void run_jq_tests(jv, int, FILE *, int, int);
13+
static void run_jq_start_state_tests();
1314
#ifdef HAVE_PTHREAD
1415
static void run_jq_pthread_tests();
1516
#endif
@@ -37,6 +38,7 @@ int jq_testsuite(jv libdirs, int verbose, int argc, char* argv[]) {
3738
}
3839
}
3940
run_jq_tests(libdirs, verbose, testdata, skip, take);
41+
run_jq_start_state_tests();
4042
#ifdef HAVE_PTHREAD
4143
run_jq_pthread_tests();
4244
#endif
@@ -251,6 +253,66 @@ static void run_jq_tests(jv lib_dirs, int verbose, FILE *testdata, int skip, int
251253
}
252254

253255

256+
static int test_start_state(jq_state *jq, char *prog) {
257+
int pass = 1;
258+
jv message = jq_get_error_message(jq);
259+
if (jv_is_valid(message)) {
260+
printf("*** Expected error_message to be invalid after jq_start: %s\n", prog);
261+
pass = 0;
262+
}
263+
jv_free(message);
264+
265+
jv exit_code = jq_get_exit_code(jq);
266+
if (jv_is_valid(exit_code)) {
267+
printf("*** Expected exit_code to be invalid after jq_start: %s\n", prog);
268+
pass = 0;
269+
}
270+
jv_free(exit_code);
271+
272+
if (jq_halted(jq)) {
273+
printf("*** Expected jq to not be halted after jq_start: %s\n", prog);
274+
pass = 0;
275+
}
276+
277+
return pass;
278+
}
279+
280+
// Test jq_state is reset after subsequent calls to jq_start.
281+
static void test_jq_start_resets_state(char *prog, const char *input) {
282+
printf("Test jq_state: %s\n", prog);
283+
jq_state *jq = jq_init();
284+
assert(jq);
285+
286+
int compiled = jq_compile(jq, prog);
287+
assert(compiled);
288+
289+
// First call to jq_start. Run until completion.
290+
jv parsed_input = jv_parse(input);
291+
assert(jv_is_valid(parsed_input));
292+
jq_start(jq, parsed_input, 0);
293+
assert(test_start_state(jq, prog));
294+
while (1) {
295+
jv result = jq_next(jq);
296+
int valid = jv_is_valid(result);
297+
jv_free(result);
298+
if (!valid) { break; }
299+
}
300+
301+
// Second call to jq_start.
302+
jv parsed_input2 = jv_parse(input);
303+
assert(jv_is_valid(parsed_input2));
304+
jq_start(jq, parsed_input2, 0);
305+
assert(test_start_state(jq, prog));
306+
307+
jq_teardown(&jq);
308+
}
309+
310+
static void run_jq_start_state_tests() {
311+
test_jq_start_resets_state(".[]", "[1,2,3]");
312+
test_jq_start_resets_state(".[] | if .%2 == 0 then halt_error else . end", "[1,2,3]");
313+
}
314+
315+
254316
/// pthread regression test
255317
#ifdef HAVE_PTHREAD
256318
#define NUMBER_OF_THREADS 3

0 commit comments

Comments
 (0)