From b8f7032b2378ad5140908f50da466efe081d0afb Mon Sep 17 00:00:00 2001 From: "jan.nijtmans" Date: Thu, 13 Dec 2012 10:48:04 +0000 Subject: Fix Tcl_DecrRefCount macro, not to refer to its objPtr parameter twice. --- generic/tcl.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/generic/tcl.h b/generic/tcl.h index 36077e6..48fe062 100644 --- a/generic/tcl.h +++ b/generic/tcl.h @@ -810,9 +810,7 @@ typedef struct Tcl_Obj { * Note: clients should use Tcl_DecrRefCount() when they are finished using * an object, and should never call TclFreeObj() directly. TclFreeObj() is * only defined and made public in tcl.h to support Tcl_DecrRefCount's macro - * definition. Note also that Tcl_DecrRefCount() refers to the parameter - * "obj" twice. This means that you should avoid calling it with an - * expression that is expensive to compute or has side effects. + * definition. */ void Tcl_IncrRefCount _ANSI_ARGS_((Tcl_Obj *objPtr)); void Tcl_DecrRefCount _ANSI_ARGS_((Tcl_Obj *objPtr)); @@ -833,7 +831,12 @@ int Tcl_IsShared _ANSI_ARGS_((Tcl_Obj *objPtr)); * http://c2.com/cgi/wiki?TrivialDoWhileLoop */ # define Tcl_DecrRefCount(objPtr) \ - do { if (--(objPtr)->refCount <= 0) TclFreeObj(objPtr); } while(0) + do { \ + Tcl_Obj *obj = (objPtr); \ + if ((obj)->refCount-- < 2) { \ + TclFreeObj(obj); \ + } \ + } while(0) # define Tcl_IsShared(objPtr) \ ((objPtr)->refCount > 1) #endif -- cgit v0.12 From e30259f5920c3e4e6a6ff76d6c7d80bdbfd5ac32 Mon Sep 17 00:00:00 2001 From: "jan.nijtmans" Date: Thu, 13 Dec 2012 12:03:51 +0000 Subject: Changelog entry, and change macro variable to not conflict with possible outside variable names --- ChangeLog | 5 +++++ generic/tcl.h | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index ef04907..092d5f9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2012-12-13 Jan Nijtmans + + * generic/tcl.h: Fix Tcl_DecrRefCount macro such that it + doesn't access its objPtr parameter twice any more. + 2012-11-14 Donal K. Fellows * unix/tclUnixPipe.c (DefaultTempDir): [Bug 2933003]: Allow overriding diff --git a/generic/tcl.h b/generic/tcl.h index 48fe062..bf9b446 100644 --- a/generic/tcl.h +++ b/generic/tcl.h @@ -832,9 +832,9 @@ int Tcl_IsShared _ANSI_ARGS_((Tcl_Obj *objPtr)); */ # define Tcl_DecrRefCount(objPtr) \ do { \ - Tcl_Obj *obj = (objPtr); \ - if ((obj)->refCount-- < 2) { \ - TclFreeObj(obj); \ + Tcl_Obj *_objPtr = (objPtr); \ + if (_objPtr->refCount-- < 2) { \ + TclFreeObj(_objPtr); \ } \ } while(0) # define Tcl_IsShared(objPtr) \ -- cgit v0.12 From 86ced50657a467a7e29470be90d1d13061b84a2d Mon Sep 17 00:00:00 2001 From: mig Date: Thu, 13 Dec 2012 13:37:19 +0000 Subject: Fix for [Bug 3595576], found by andrewsh --- ChangeLog | 7 +++++++ generic/tclCmdAH.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 87f0260..13fcaf8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2012-11-13 Miguel Sofer + + * generic/tclCmdAH.c (CatchObjCmdCallback): do not decrRefCount + the newValuePtr sent to Tcl_ObjSetVar2: TOSV2 is 'fire and + forget', it decrs on its own. Fix for [Bug 3595576], found by + andrewsh. + 2012-12-13 Jan Nijtmans * generic/tcl.h: Fix Tcl_DecrRefCount macro such that it diff --git a/generic/tclCmdAH.c b/generic/tclCmdAH.c index 14951e4..133a61b 100644 --- a/generic/tclCmdAH.c +++ b/generic/tclCmdAH.c @@ -361,7 +361,8 @@ CatchObjCmdCallback( if (NULL == Tcl_ObjSetVar2(interp, optionVarNamePtr, NULL, options, TCL_LEAVE_ERR_MSG)) { - Tcl_DecrRefCount(options); + /* Do not decrRefCount 'options', it was already done by + * Tcl_ObjSetVar2 */ return TCL_ERROR; } } -- cgit v0.12 From 7cf0ac1eafc58e6473a6f2d2e2c0480628ac626c Mon Sep 17 00:00:00 2001 From: dgp Date: Thu, 13 Dec 2012 15:59:51 +0000 Subject: 3595576 Tests/fix for mem corruption: [catch] fails to store options in a var. --- generic/tclCmdAH.c | 1 - tests/cmdAH.test | 6 ++++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/generic/tclCmdAH.c b/generic/tclCmdAH.c index 8e32389..44f08a3 100644 --- a/generic/tclCmdAH.c +++ b/generic/tclCmdAH.c @@ -273,7 +273,6 @@ Tcl_CatchObjCmd( Tcl_Obj *options = Tcl_GetReturnOptions(interp, result); if (NULL == Tcl_ObjSetVar2(interp, optionVarNamePtr, NULL, options, 0)) { - Tcl_DecrRefCount(options); Tcl_ResetResult(interp); Tcl_AppendResult(interp, "couldn't save return options in variable", NULL); diff --git a/tests/cmdAH.test b/tests/cmdAH.test index 2e94d7d..fb0fefc 100644 --- a/tests/cmdAH.test +++ b/tests/cmdAH.test @@ -46,6 +46,12 @@ test cmdAH-1.2 {Tcl_CatchObjCmd, errors} { test cmdAH-1.3 {Tcl_CatchObjCmd, errors} { list [catch {catch foo bar baz spaz} msg] $msg } {1 {wrong # args: should be "catch script ?resultVarName? ?optionVarName?"}} +test cmdAH-1.4 {Bug 3595576} { + catch {catch {} -> noSuchNs::var} +} 1 +test cmdAH-1.5 {Bug 3595576} { + catch {catch error -> noSuchNs::var} +} 1 test cmdAH-2.1 {Tcl_CdObjCmd} { list [catch {cd foo bar} msg] $msg -- cgit v0.12 From 990ca78bafc3a3a4363dbdaca20c2c3f78b8ee83 Mon Sep 17 00:00:00 2001 From: dgp Date: Thu, 13 Dec 2012 16:11:07 +0000 Subject: Restore clarity to macro test. --- generic/tcl.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generic/tcl.h b/generic/tcl.h index bf9b446..9dd6ff0 100644 --- a/generic/tcl.h +++ b/generic/tcl.h @@ -833,7 +833,7 @@ int Tcl_IsShared _ANSI_ARGS_((Tcl_Obj *objPtr)); # define Tcl_DecrRefCount(objPtr) \ do { \ Tcl_Obj *_objPtr = (objPtr); \ - if (_objPtr->refCount-- < 2) { \ + if (--(_objPtr)->refCount <= 0) { \ TclFreeObj(_objPtr); \ } \ } while(0) -- cgit v0.12 From 4eaff43e124f523dca05591bc760fa9f32eb7672 Mon Sep 17 00:00:00 2001 From: dgp Date: Thu, 13 Dec 2012 20:20:46 +0000 Subject: TIP 400 suffered from the same segfaulting flaw as 3595576. Segfaulting test and fix committed. --- generic/tclZlib.c | 19 +++---------------- tests/zlib.test | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/generic/tclZlib.c b/generic/tclZlib.c index 8fbe049..9c1176e 100644 --- a/generic/tclZlib.c +++ b/generic/tclZlib.c @@ -507,7 +507,7 @@ GenerateHeader( * ExtractHeader -- * * Take the values out of a gzip header and store them in a dictionary. - * SetValue is a helper function. + * SetValue is a helper macro. * * Results: * None. @@ -518,18 +518,8 @@ GenerateHeader( *---------------------------------------------------------------------- */ -static inline void -SetValue( - Tcl_Obj *dictObj, - const char *key, - Tcl_Obj *value) -{ - Tcl_Obj *keyObj = Tcl_NewStringObj(key, -1); - - Tcl_IncrRefCount(keyObj); - Tcl_DictObjPut(NULL, dictObj, keyObj, value); - TclDecrRefCount(keyObj); -} +#define SetValue(dictObj, key, value) \ + Tcl_DictObjPut(NULL, (dictObj), Tcl_NewStringObj((key), -1), (value)) static void ExtractHeader( @@ -2119,9 +2109,6 @@ ZlibCmd( } if (headerVarObj != NULL && Tcl_ObjSetVar2(interp, headerVarObj, NULL, headerDictObj, TCL_LEAVE_ERR_MSG) == NULL) { - if (headerDictObj) { - TclDecrRefCount(headerDictObj); - } return TCL_ERROR; } return TCL_OK; diff --git a/tests/zlib.test b/tests/zlib.test index 5f1e5fc..891dba0 100644 --- a/tests/zlib.test +++ b/tests/zlib.test @@ -826,6 +826,20 @@ test zlib-11.2 "Bug #3390073: mis-appled gzip filtering" -setup { } -cleanup { removeFile $file } -result {1000 /foo/bar 0} +test zlib-11.3 {Bug 3595576 variant} -setup { + set file [makeFile {} test.input] +} -constraints zlib -body { + set f [open $file wb] + puts -nonewline [zlib push gzip $f -header {filename /foo/bar}] \ + [string repeat "hello" 1000] + close $f + set f [open $file rb] + set d [read $f] + close $f + zlib gunzip $d -header noSuchNs::foo +} -cleanup { + removeFile $file +} -returnCodes error -result {can't set "noSuchNs::foo": parent namespace doesn't exist} ::tcltest::cleanupTests return -- cgit v0.12