[32ae34e63a] Prevent segfaults and data corruption when CopyData() is called recursively.

Mark new test io-53.20 as "knownBug". It demos some unknown flaw in MoveBytes().

4 files changed, 241 insertions, 25 deletions

diff --git a/generic/tclIO.c b/generic/tclIO.c
index aad576a..b7f895f 100644
--- a/generic/tclIO.c
+++ b/generic/tclIO.c
@@ -102,11 +102,30 @@ typedef struct CopyState {
     Tcl_WideInt total;		/* Total bytes transferred (written). */
     Tcl_Interp *interp;		/* Interp that started the copy. */
     Tcl_Obj *cmdPtr;		/* Command to be invoked at completion. */
+    int refCount;		/* Claim count on the struct */
+    int bufInUse;		/* Flag to govern access to buffer */
     int bufSize;		/* Size of appended buffer. */
     char buffer[1];		/* Copy buffer, this must be the last
                                  * field. */
 } CopyState;
 
+static void
+PreserveCopyState(
+    CopyState *csPtr)
+{
+    csPtr->refCount++;
+}
+
+static void
+ReleaseCopyState(
+    CopyState *csPtr)
+{
+    if (--csPtr->refCount) {
+	return;
+    }
+    ckfree(csPtr);
+}
+
 /*
  * All static variables used in this file are collected into a single instance
  * of the following structure. For multi-threaded implementations, there is
@@ -9085,9 +9104,13 @@ TclCopyChannel(
 	Tcl_IncrRefCount(cmdPtr);
     }
     csPtr->cmdPtr = cmdPtr;
+    csPtr->refCount = 1;
+    csPtr->bufInUse = 0;
 
     inStatePtr->csPtrR  = csPtr;
+    PreserveCopyState(csPtr);
     outStatePtr->csPtrW = csPtr;
+    PreserveCopyState(csPtr);
 
     if (moveBytes) {
 	return MoveBytes(csPtr);
@@ -9373,6 +9396,11 @@ CopyData(
 				/* Encoding control */
     int underflow;		/* Input underflow */
 
+    if (csPtr->bufInUse) {
+	return TCL_OK;
+    }
+    PreserveCopyState(csPtr);
+
     inChan	= (Tcl_Channel) csPtr->readPtr;
     outChan	= (Tcl_Channel) csPtr->writePtr;
     inStatePtr	= csPtr->readPtr->state;
@@ -9435,6 +9463,7 @@ CopyData(
 		sizeb = (int) csPtr->toRead;
 	    }
 
+	    csPtr->bufInUse = 1;
 	    if (inBinary || sameEncoding) {
 		size = DoRead(inStatePtr->topChanPtr, csPtr->buffer, sizeb,
                               !GotFlag(inStatePtr, CHANNEL_NONBLOCKING));
@@ -9490,6 +9519,7 @@ CopyData(
 		    TclDecrRefCount(bufObj);
 		    bufObj = NULL;
 		}
+		ReleaseCopyState(csPtr);
 		return TCL_OK;
 	    }
 	}
@@ -9510,6 +9540,7 @@ CopyData(
 	} else {
 	    sizeb = WriteChars(outStatePtr->topChanPtr, buffer, sizeb);
 	}
+	csPtr->bufInUse = 0;
 
 	/*
 	 * [Bug 2895565]. At this point 'size' still contains the number of
@@ -9581,6 +9612,7 @@ CopyData(
 		TclDecrRefCount(bufObj);
 		bufObj = NULL;
 	    }
+	    ReleaseCopyState(csPtr);
 	    return TCL_OK;
 	}
 
@@ -9603,6 +9635,7 @@ CopyData(
 		TclDecrRefCount(bufObj);
 		bufObj = NULL;
 	    }
+	    ReleaseCopyState(csPtr);
 	    return TCL_OK;
 	}
     } /* while */
@@ -9618,7 +9651,7 @@ CopyData(
      */
 
     total = csPtr->total;
-    if (cmdPtr && interp) {
+    if (cmdPtr && interp && csPtr->cmdPtr) {
 	int code;
 
 	/*
@@ -9626,8 +9659,7 @@ CopyData(
 	 * arguments. Note that StopCopy frees our saved reference to the
 	 * original command obj.
 	 */
-
-	cmdPtr = Tcl_DuplicateObj(cmdPtr);
+	cmdPtr = Tcl_DuplicateObj(csPtr->cmdPtr);
 	Tcl_IncrRefCount(cmdPtr);
 	StopCopy(csPtr);
 	Tcl_Preserve(interp);
@@ -9655,6 +9687,7 @@ CopyData(
 	    }
 	}
     }
+    ReleaseCopyState(csPtr);
     return result;
 }
 
@@ -9972,10 +10005,16 @@ StopCopy(
 	Tcl_DeleteChannelHandler(inChan, MBEvent, csPtr);
 	Tcl_DeleteChannelHandler(outChan, MBEvent, csPtr);
 	TclDecrRefCount(csPtr->cmdPtr);
+	csPtr->cmdPtr = NULL;
     }
+    if (inStatePtr->csPtrR == NULL) {
+	return;
+    }
+    ReleaseCopyState(inStatePtr->csPtrR);
     inStatePtr->csPtrR = NULL;
+    ReleaseCopyState(outStatePtr->csPtrW);
     outStatePtr->csPtrW = NULL;
-    ckfree(csPtr);
+    ReleaseCopyState(csPtr);
 }
 
 /*
diff --git a/generic/tclIORChan.c b/generic/tclIORChan.c
index 21c766e..a387410 100644
--- a/generic/tclIORChan.c
+++ b/generic/tclIORChan.c
@@ -1601,14 +1601,6 @@ ReflectWatch(
 
     mask &= rcPtr->mode;
 
-    if (mask == rcPtr->interest) {
-	/*
-	 * Same old, same old, why should we do something?
-	 */
-
-	return;
-    }
-
     rcPtr->interest = mask;
 
     /*
diff --git a/tests/io.test b/tests/io.test
index 6b6ad6d..783bc75 100644
--- a/tests/io.test
+++ b/tests/io.test
@@ -8003,6 +8003,191 @@ test io-53.17 {[7c187a3773] MBWrite: proper inQueueTail handling} -setup {
     close $c
     removeFile out
 } -result {line 100 line}
+test io-53.18 {[32ae34e63a] recursive CopyData} -setup {
+    proc driver {cmd args} {
+        variable buffer
+        variable index
+        set chan [lindex $args 0]
+        switch -- $cmd {
+            initialize {
+                set index($chan) 0
+                set buffer($chan) [encoding convertto utf-8 \
+                        [string repeat a 100]]
+                return {initialize finalize watch read}
+            }
+            finalize {
+                unset index($chan) buffer($chan)
+                return
+            }
+            watch {
+                if {"read" in [lindex $args 1]} {
+                    chan postevent $chan read
+                }
+                return
+            }
+            read {
+                set n [lindex $args 1]
+                set new [expr {$index($chan) + $n}]
+                set result [string range $buffer($chan) $index($chan) $new-1]
+                set index($chan) $new
+                return $result
+            }
+        }
+    }
+    proc more {c outChan bytes args} {
+        if {[eof $c]} {
+            set ::done eof
+            catch {close $c}
+            return
+        }
+        if {[llength $args]} {
+            set ::done error
+        } else  {
+            chan copy $c $outChan -command [list [namespace which more] $c $outChan]
+        }
+    }
+    set c [chan create read [namespace which driver]]
+    chan configure $c -encoding utf-8
+    set out [makeFile {} out]
+    set outChan [open $out w]
+    # Different encoding to force use of DoReadChars()
+    chan configure $outChan -encoding iso8859-1
+} -body {
+    after 100 {set ::done timeout}
+    chan copy $c $outChan -size 99 -command [list [namespace which more] $c $outChan]
+    vwait ::done
+    set ::done
+} -cleanup {
+    close $outChan
+    removeFile out
+    rename driver {}
+    rename more {}
+    unset ::done
+} -result eof
+
+test io-53.19 {[32ae34e63a] stop ReflectWatch filtering} -setup {
+    proc driver {cmd args} {
+        variable buffer
+        variable index
+        set chan [lindex $args 0]
+        switch -- $cmd {
+            initialize {
+                set index($chan) 0
+                set buffer($chan) [encoding convertto utf-8 \
+                        [string repeat a 100]]
+                return {initialize finalize watch read}
+            }
+            finalize {
+                unset index($chan) buffer($chan)
+                return
+            }
+            watch {
+                if {"read" in [lindex $args 1]} {
+                    chan postevent $chan read
+                }
+                return
+            }
+            read {
+                set n [lindex $args 1]
+                set new [expr {$index($chan) + $n}]
+                set result [string range $buffer($chan) $index($chan) $new-1]
+                set index($chan) $new
+                return $result
+            }
+        }
+    }
+    proc more {c outChan bytes args} {
+        if {[eof $c]} {
+            set ::done eof
+            catch {close $c}
+            return
+        }
+        if {[llength $args]} {
+            set ::done error
+        } else  {
+            chan copy $c $outChan -size 30 -command [list [namespace which more] $c $outChan]
+        }
+    }
+    set c [chan create read [namespace which driver]]
+    chan configure $c -encoding utf-8 -buffersize 20
+    set out [makeFile {} out]
+    set outChan [open $out w]
+    # Different encoding to force use of DoReadChars()
+    chan configure $outChan -encoding iso8859-1
+} -body {
+    after 100 {set ::done timeout}
+    chan copy $c $outChan -size 30 -command [list [namespace which more] $c $outChan]
+    vwait ::done
+    set ::done
+} -cleanup {
+    catch {close $outChan}
+    removeFile out
+    rename driver {}
+    rename more {}
+    unset ::done
+} -result eof
+
+test io-53.20 {[e0a7b3e5f8] DoRead calls to UpdateInterest} -constraints knownBug -setup {
+    proc driver {cmd args} {
+        variable buffer
+        variable index
+        set chan [lindex $args 0]
+        switch -- $cmd {
+            initialize {
+                set index($chan) 0
+                set buffer($chan) [encoding convertto utf-8 \
+                        [string repeat a 100]]
+                return {initialize finalize watch read}
+            }
+            finalize {
+                unset index($chan) buffer($chan)
+                return
+            }
+            watch {
+                if {"read" in [lindex $args 1]} {
+                    chan postevent $chan read
+                }
+                return
+            }
+            read {
+                set n [lindex $args 1]
+                set new [expr {$index($chan) + $n}]
+                set result [string range $buffer($chan) $index($chan) $new-1]
+                set index($chan) $new
+                return $result
+            }
+        }
+    }
+    proc more {c outChan bytes args} {
+        if {[eof $c]} {
+            set ::done eof
+            catch {close $c}
+            return
+        }
+        if {[llength $args]} {
+            set ::done error
+        } else  {
+            chan copy $c $outChan -size 10 -command [list [namespace which more] $c $outChan]
+        }
+    }
+    set c [chan create read [namespace which driver]]
+    chan configure $c -encoding utf-8 -buffersize 20
+    set out [makeFile {} out]
+    set outChan [open $out w]
+    # Same encoding to force use of DoRead()
+    chan configure $outChan -encoding utf-8
+} -body {
+    after 100 {set ::done timeout}
+    chan copy $c $outChan -size 10 -command [list [namespace which more] $c $outChan]
+    vwait ::done
+    set ::done
+} -cleanup {
+    catch {close $outChan}
+    removeFile out
+    rename driver {}
+    rename more {}
+    unset ::done
+} -result eof
 
 test io-54.1 {Recursive channel events} {socket fileevent} {
     # This test checks to see if file events are delivered during recursive
diff --git a/tests/ioCmd.test b/tests/ioCmd.test
index cd89a02..a0caab2 100644
--- a/tests/ioCmd.test
+++ b/tests/ioCmd.test
@@ -1019,7 +1019,7 @@ test iocmd-23.1 {chan read, regular data return} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} {read rc* 4096} snarfsnarf}
+} -result {{read rc* 4096} {read rc* 4096} {watch rc* {}} snarfsnarf}
 test iocmd-23.2 {chan read, bad data return, to much} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1031,7 +1031,7 @@ test iocmd-23.2 {chan read, bad data return, to much} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 {read delivered more than requested}}
+} -result {{read rc* 4096} {watch rc* {}} 1 {read delivered more than requested}}
 test iocmd-23.3 {chan read, for non-readable channel} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1054,7 +1054,7 @@ test iocmd-23.4 {chan read, error return} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 BOOM!}
+} -result {{read rc* 4096} {watch rc* {}} 1 BOOM!}
 test iocmd-23.5 {chan read, break return is error} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1066,7 +1066,7 @@ test iocmd-23.5 {chan read, break return is error} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code*}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code*}
 test iocmd-23.6 {chan read, continue return is error} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1078,7 +1078,7 @@ test iocmd-23.6 {chan read, continue return is error} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code*}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code*}
 test iocmd-23.7 {chan read, custom return is error} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1090,7 +1090,7 @@ test iocmd-23.7 {chan read, custom return is error} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code*}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code*}
 test iocmd-23.8 {chan read, level is squashed} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1102,7 +1102,7 @@ test iocmd-23.8 {chan read, level is squashed} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code* {-code 1 -level 0 -errorcode NONE -errorline 1 -errorinfo *bad code*subcommand "read"*}}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code* {-code 1 -level 0 -errorcode NONE -errorline 1 -errorinfo *bad code*subcommand "read"*}}
 test iocmd-23.9 {chan read, no data means eof} -match glob -setup {
     set res {}
     proc foo {args} {
@@ -1118,7 +1118,7 @@ test iocmd-23.9 {chan read, no data means eof} -match glob -setup {
     close $c
     rename foo {}
     unset res
-} -result {{read rc* 4096} {} 1}
+} -result {{read rc* 4096} {watch rc* {}} {} 1}
 test iocmd-23.10 {chan read, EAGAIN means no data, yet no eof either} -match glob -setup {
     set res {}
     proc foo {args} {
@@ -1134,7 +1134,7 @@ test iocmd-23.10 {chan read, EAGAIN means no data, yet no eof either} -match glo
     close $c
     rename foo {}
     unset res
-} -result {{read rc* 4096} {} 0}
+} -result {{read rc* 4096} {watch rc* {}} {} 0}
 test iocmd-23.11 {chan read, close pulls the rug out} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1448,14 +1448,14 @@ test iocmd-25.10 {chan configure, cgetall, level is ignored} -match glob -body {
 test iocmd-26.1 {chan configure, set standard option} -match glob -body {
     set res {}
     proc foo {args} {
-	oninit configure; onfinal; track; note MUST_NOT_HAPPEN; return
+	oninit configure; onfinal; track; return
     }
     set c [chan create {r w} foo]
     note [fconfigure $c -translation lf]
     close $c
     rename foo {}
     set res
-} -result {{}}
+} -result {{watch rc* {}} {}}
 test iocmd-26.2 {chan configure, set option, error return} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1993,7 +1993,7 @@ test iocmd-31.6 {chan postevent, posted events do happen} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{watch rc* read} {} TOCK {} {watch rc* {}}}
+} -result {{watch rc* read} {} TOCK {watch rc* read} {} {watch rc* {}}}
 test iocmd-31.7 {chan postevent, posted events do happen} -match glob -body {
     set res {}
     proc foo {args} {oninit; onfinal; track; return}
@@ -2006,7 +2006,7 @@ test iocmd-31.7 {chan postevent, posted events do happen} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{watch rc* write} {} TOCK {} {watch rc* {}}}
+} -result {{watch rc* write} {} TOCK {watch rc* write} {} {watch rc* {}}}
 test iocmd-31.8 {chan postevent after close throws error} -match glob -setup {
     proc foo {args} {oninit; onfinal; track; return}
     proc dummy args { return }