[32ae34e63a] Prevent segfaults and data corruption when CopyData() is called

recursively.

4 files changed, 242 insertions, 25 deletions

diff --git a/generic/tclIO.c b/generic/tclIO.c
index 564df27..09b2537 100644
--- a/generic/tclIO.c
+++ b/generic/tclIO.c
@@ -113,11 +113,30 @@ typedef struct CopyState {
     Tcl_WideInt total;		/* Total bytes transferred (written). */
     Tcl_Interp *interp;		/* Interp that started the copy. */
     Tcl_Obj *cmdPtr;		/* Command to be invoked at completion. */
+    int refCount;		/* Claim count on the struct */
+    int bufInUse;		/* Flag to govern access to buffer */
     int bufSize;		/* Size of appended buffer. */
     char buffer[1];		/* Copy buffer, this must be the last
                                  * field. */
 } CopyState;
 
+static void
+PreserveCopyState(
+    CopyState *csPtr)
+{
+    csPtr->refCount++;
+}
+
+static void
+ReleaseCopyState(
+    CopyState *csPtr)
+{
+    if (--csPtr->refCount) {
+	return;
+    }
+    ckfree((char *) csPtr);
+}
+
 /*
  * All static variables used in this file are collected into a single instance
  * of the following structure. For multi-threaded implementations, there is
@@ -8642,9 +8661,13 @@ TclCopyChannel(
 	Tcl_IncrRefCount(cmdPtr);
     }
     csPtr->cmdPtr = cmdPtr;
+    csPtr->refCount = 1;
+    csPtr->bufInUse = 0;
 
     inStatePtr->csPtrR  = csPtr;
+    PreserveCopyState(csPtr);
     outStatePtr->csPtrW = csPtr;
+    PreserveCopyState(csPtr);
 
     /*
      * Special handling of -size 0 async transfers, so that the -command is
@@ -8696,6 +8719,11 @@ CopyData(
 				/* Encoding control */
     int underflow;		/* Input underflow */
 
+    if (csPtr->bufInUse) {
+	return TCL_OK;
+    }
+    PreserveCopyState(csPtr);
+
     inChan	= (Tcl_Channel) csPtr->readPtr;
     outChan	= (Tcl_Channel) csPtr->writePtr;
     inStatePtr	= csPtr->readPtr->state;
@@ -8757,6 +8785,7 @@ CopyData(
 		sizeb = csPtr->toRead;
 	    }
 
+	    csPtr->bufInUse = 1;
 	    if (inBinary || sameEncoding) {
 		size = DoRead(inStatePtr->topChanPtr, csPtr->buffer, sizeb);
 	    } else {
@@ -8807,6 +8836,7 @@ CopyData(
 		    TclDecrRefCount(bufObj);
 		    bufObj = NULL;
 		}
+		ReleaseCopyState(csPtr);
 		return TCL_OK;
 	    }
 	}
@@ -8827,6 +8857,7 @@ CopyData(
 	} else {
 	    sizeb = WriteChars(outStatePtr->topChanPtr, buffer, sizeb);
 	}
+	csPtr->bufInUse = 0;
 
 	/*
 	 * [Bug 2895565]. At this point 'size' still contains the number of
@@ -8898,6 +8929,7 @@ CopyData(
 		TclDecrRefCount(bufObj);
 		bufObj = NULL;
 	    }
+	    ReleaseCopyState(csPtr);
 	    return TCL_OK;
 	}
 
@@ -8920,6 +8952,7 @@ CopyData(
 		TclDecrRefCount(bufObj);
 		bufObj = NULL;
 	    }
+	    ReleaseCopyState(csPtr);
 	    return TCL_OK;
 	}
     } /* while */
@@ -8935,15 +8968,14 @@ CopyData(
      */
 
     total = csPtr->total;
-    if (cmdPtr && interp) {
+    if (cmdPtr && interp && csPtr->cmdPtr) {
 	int code;
 	/*
 	 * Get a private copy of the command so we can mutate it by adding
 	 * arguments. Note that StopCopy frees our saved reference to the
 	 * original command obj.
 	 */
-
-	cmdPtr = Tcl_DuplicateObj(cmdPtr);
+	cmdPtr = Tcl_DuplicateObj(csPtr->cmdPtr);
 	Tcl_IncrRefCount(cmdPtr);
 	StopCopy(csPtr);
 	Tcl_Preserve(interp);
@@ -8971,6 +9003,7 @@ CopyData(
 	    }
 	}
     }
+    ReleaseCopyState(csPtr);
     return result;
 }
 
@@ -9284,10 +9317,16 @@ StopCopy(
 		    CopyEventProc, csPtr);
 	}
 	TclDecrRefCount(csPtr->cmdPtr);
+	csPtr->cmdPtr = NULL;
+    }
+    if (inStatePtr->csPtrR == NULL) {
+	return;
     }
+    ReleaseCopyState(inStatePtr->csPtrR);
     inStatePtr->csPtrR = NULL;
+    ReleaseCopyState(outStatePtr->csPtrW);
     outStatePtr->csPtrW = NULL;
-    ckfree((char *) csPtr);
+    ReleaseCopyState(csPtr);
 }
 
 /*
diff --git a/generic/tclIORChan.c b/generic/tclIORChan.c
index bbb5b88..2e5fa45 100644
--- a/generic/tclIORChan.c
+++ b/generic/tclIORChan.c
@@ -1508,14 +1508,6 @@ ReflectWatch(
 
     mask &= rcPtr->mode;
 
-    if (mask == rcPtr->interest) {
-	/*
-	 * Same old, same old, why should we do something?
-	 */
-
-	return;
-    }
-
     rcPtr->interest = mask;
 
     /*
diff --git a/tests/io.test b/tests/io.test
index 50c5808..914cbca 100644
--- a/tests/io.test
+++ b/tests/io.test
@@ -7886,6 +7886,192 @@ test io-53.15 {[ed29c4da21] DoRead: fblocked seen as error} -setup {
     removeFile out
 } -result 100
 
+test io-53.18 {[32ae34e63a] recursive CopyData} -setup {
+    proc driver {cmd args} {
+        variable buffer
+        variable index
+        set chan [lindex $args 0]
+        switch -- $cmd {
+            initialize {
+                set index($chan) 0
+                set buffer($chan) [encoding convertto utf-8 \
+                        [string repeat a 100]]
+                return {initialize finalize watch read}
+            }
+            finalize {
+                unset index($chan) buffer($chan)
+                return
+            }
+            watch {
+                if {"read" in [lindex $args 1]} {
+                    chan postevent $chan read
+                }
+                return
+            }
+            read {
+                set n [lindex $args 1]
+                set new [expr {$index($chan) + $n}]
+                set result [string range $buffer($chan) $index($chan) $new-1]
+                set index($chan) $new
+                return $result
+            }
+        }
+    }
+    proc more {c outChan bytes args} {
+        if {[eof $c]} {
+            set ::done eof
+            catch {close $c}
+            return
+        }
+        if {[llength $args]} {
+            set ::done error
+        } else  {
+            chan copy $c $outChan -command [list [namespace which more] $c $outChan]
+        }
+    }
+    set c [chan create read [namespace which driver]]
+    chan configure $c -encoding utf-8
+    set out [makeFile {} out]
+    set outChan [open $out w]
+    # Different encoding to force use of DoReadChars()
+    chan configure $outChan -encoding iso8859-1
+} -body {
+    after 100 {set ::done timeout}
+    chan copy $c $outChan -size 99 -command [list [namespace which more] $c $outChan]
+    vwait ::done
+    set ::done
+} -cleanup {
+    close $outChan
+    removeFile out
+    rename driver {}
+    rename more {}
+    unset ::done
+} -result eof
+
+test io-53.19 {[32ae34e63a] stop ReflectWatch filtering} -setup {
+    proc driver {cmd args} {
+        variable buffer
+        variable index
+        set chan [lindex $args 0]
+        switch -- $cmd {
+            initialize {
+                set index($chan) 0
+                set buffer($chan) [encoding convertto utf-8 \
+                        [string repeat a 100]]
+                return {initialize finalize watch read}
+            }
+            finalize {
+                unset index($chan) buffer($chan)
+                return
+            }
+            watch {
+                if {"read" in [lindex $args 1]} {
+                    chan postevent $chan read
+                }
+                return
+            }
+            read {
+                set n [lindex $args 1]
+                set new [expr {$index($chan) + $n}]
+                set result [string range $buffer($chan) $index($chan) $new-1]
+                set index($chan) $new
+                return $result
+            }
+        }
+    }
+    proc more {c outChan bytes args} {
+        if {[eof $c]} {
+            set ::done eof
+            catch {close $c}
+            return
+        }
+        if {[llength $args]} {
+            set ::done error
+        } else  {
+            chan copy $c $outChan -size 30 -command [list [namespace which more] $c $outChan]
+        }
+    }
+    set c [chan create read [namespace which driver]]
+    chan configure $c -encoding utf-8 -buffersize 20
+    set out [makeFile {} out]
+    set outChan [open $out w]
+    # Different encoding to force use of DoReadChars()
+    chan configure $outChan -encoding iso8859-1
+} -body {
+    after 100 {set ::done timeout}
+    chan copy $c $outChan -size 30 -command [list [namespace which more] $c $outChan]
+    vwait ::done
+    set ::done
+} -cleanup {
+    catch {close $outChan}
+    removeFile out
+    rename driver {}
+    rename more {}
+    unset ::done
+} -result eof
+
+test io-53.20 {[e0a7b3e5f8] DoRead calls to UpdateInterest} -setup {
+    proc driver {cmd args} {
+        variable buffer
+        variable index
+        set chan [lindex $args 0]
+        switch -- $cmd {
+            initialize {
+                set index($chan) 0
+                set buffer($chan) [encoding convertto utf-8 \
+                        [string repeat a 100]]
+                return {initialize finalize watch read}
+            }
+            finalize {
+                unset index($chan) buffer($chan)
+                return
+            }
+            watch {
+                if {"read" in [lindex $args 1]} {
+                    chan postevent $chan read
+                }
+                return
+            }
+            read {
+                set n [lindex $args 1]
+                set new [expr {$index($chan) + $n}]
+                set result [string range $buffer($chan) $index($chan) $new-1]
+                set index($chan) $new
+                return $result
+            }
+        }
+    }
+    proc more {c outChan bytes args} {
+        if {[eof $c]} {
+            set ::done eof
+            catch {close $c}
+            return
+        }
+        if {[llength $args]} {
+            set ::done error
+        } else  {
+            chan copy $c $outChan -size 10 -command [list [namespace which more] $c $outChan]
+        }
+    }
+    set c [chan create read [namespace which driver]]
+    chan configure $c -encoding utf-8 -buffersize 20
+    set out [makeFile {} out]
+    set outChan [open $out w]
+    # Same encoding to force use of DoRead()
+    chan configure $outChan -encoding utf-8
+} -body {
+    after 100 {set ::done timeout}
+    chan copy $c $outChan -size 10 -command [list [namespace which more] $c $outChan]
+    vwait ::done
+    set ::done
+} -cleanup {
+    catch {close $outChan}
+    removeFile out
+    rename driver {}
+    rename more {}
+    unset ::done
+} -result eof
+
 test io-54.1 {Recursive channel events} {socket fileevent} {
     # This test checks to see if file events are delivered during recursive
     # event loops when there is buffered data on the channel.
diff --git a/tests/ioCmd.test b/tests/ioCmd.test
index 5a76d48..e2a6d84 100644
--- a/tests/ioCmd.test
+++ b/tests/ioCmd.test
@@ -981,7 +981,7 @@ test iocmd-23.1 {chan read, regular data return} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} {read rc* 4096} snarfsnarf}
+} -result {{read rc* 4096} {read rc* 4096} {watch rc* {}} snarfsnarf}
 test iocmd-23.2 {chan read, bad data return, to much} -match glob -body {
     set res {}
     proc foo {args} {
@@ -993,7 +993,7 @@ test iocmd-23.2 {chan read, bad data return, to much} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 {read delivered more than requested}}
+} -result {{read rc* 4096} {watch rc* {}} 1 {read delivered more than requested}}
 test iocmd-23.3 {chan read, for non-readable channel} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1016,7 +1016,7 @@ test iocmd-23.4 {chan read, error return} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 BOOM!}
+} -result {{read rc* 4096} {watch rc* {}} 1 BOOM!}
 test iocmd-23.5 {chan read, break return is error} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1028,7 +1028,7 @@ test iocmd-23.5 {chan read, break return is error} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code*}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code*}
 test iocmd-23.6 {chan read, continue return is error} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1040,7 +1040,7 @@ test iocmd-23.6 {chan read, continue return is error} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code*}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code*}
 test iocmd-23.7 {chan read, custom return is error} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1052,7 +1052,7 @@ test iocmd-23.7 {chan read, custom return is error} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code*}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code*}
 test iocmd-23.8 {chan read, level is squashed} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1064,7 +1064,7 @@ test iocmd-23.8 {chan read, level is squashed} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{read rc* 4096} 1 *bad code* {-code 1 -level 0 -errorcode NONE -errorline 1 -errorinfo *bad code*subcommand "read"*}}
+} -result {{read rc* 4096} {watch rc* {}} 1 *bad code* {-code 1 -level 0 -errorcode NONE -errorline 1 -errorinfo *bad code*subcommand "read"*}}
 test iocmd-23.9 {chan read, no data means eof} -match glob -setup {
     set res {}
     proc foo {args} {
@@ -1080,7 +1080,7 @@ test iocmd-23.9 {chan read, no data means eof} -match glob -setup {
     close $c
     rename foo {}
     unset res
-} -result {{read rc* 4096} {} 1}
+} -result {{read rc* 4096} {watch rc* {}} {} 1}
 test iocmd-23.10 {chan read, EAGAIN means no data, yet no eof either} -match glob -setup {
     set res {}
     proc foo {args} {
@@ -1096,7 +1096,7 @@ test iocmd-23.10 {chan read, EAGAIN means no data, yet no eof either} -match glo
     close $c
     rename foo {}
     unset res
-} -result {{read rc* 4096} {} 0}
+} -result {{read rc* 4096} {watch rc* {}} {} 0}
 test iocmd-23.11 {chan read, close pulls the rug out} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1410,14 +1410,14 @@ test iocmd-25.10 {chan configure, cgetall, level is ignored} -match glob -body {
 test iocmd-26.1 {chan configure, set standard option} -match glob -body {
     set res {}
     proc foo {args} {
-	oninit configure; onfinal; track; note MUST_NOT_HAPPEN; return
+	oninit configure; onfinal; track; return
     }
     set c [chan create {r w} foo]
     note [fconfigure $c -translation lf]
     close $c
     rename foo {}
     set res
-} -result {{}}
+} -result {{watch rc* {}} {}}
 test iocmd-26.2 {chan configure, set option, error return} -match glob -body {
     set res {}
     proc foo {args} {
@@ -1955,7 +1955,7 @@ test iocmd-31.6 {chan postevent, posted events do happen} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{watch rc* read} {} TOCK {} {watch rc* {}}}
+} -result {{watch rc* read} {} TOCK {watch rc* read} {} {watch rc* {}}}
 test iocmd-31.7 {chan postevent, posted events do happen} -match glob -body {
     set res {}
     proc foo {args} {oninit; onfinal; track; return}
@@ -1968,7 +1968,7 @@ test iocmd-31.7 {chan postevent, posted events do happen} -match glob -body {
     close $c
     rename foo {}
     set res
-} -result {{watch rc* write} {} TOCK {} {watch rc* {}}}
+} -result {{watch rc* write} {} TOCK {watch rc* write} {} {watch rc* {}}}
 test iocmd-31.8 {chan postevent after close throws error} -match glob -setup {
     proc foo {args} {oninit; onfinal; track; return}
     proc dummy args { return }