Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

segfault on stack overflow when reading marshaled data #5318

Closed
vicuna opened this issue Jul 21, 2011 · 9 comments
Closed

segfault on stack overflow when reading marshaled data #5318

vicuna opened this issue Jul 21, 2011 · 9 comments
Labels

Comments

@vicuna
Copy link

vicuna commented Jul 21, 2011

Original bug ID: 5318
Reporter: eugenz
Assigned to: meyer
Status: closed (set by @xavierleroy on 2013-08-31T10:49:05Z)
Resolution: fixed
Priority: normal
Severity: crash
Version: 3.12.0
Fixed in version: 4.00.0+dev
Category: ~DO NOT USE (was: OCaml general)

Bug description

The attached code implements a doubly linked list, following the implementation of queues from the standard library.

The program sigfaults when reading the marshaled data of a doubly linked list of length more than 100000 (the minimal length for which it crashes is between 90000 and 100000). It works fine for smaller values.

Additional information

tested with ocaml, ocamlc, and ocamlopt on a 64 bit machine running Linux

File attachments

@vicuna
Copy link
Author

vicuna commented Jul 21, 2011

Comment author: @lefessan

Unfortunately, your data structure is too deep for Marshal.from_string which triggers a stack overflow. Marshal.from_string is optimized for trees, i.e. depth in log(n), and simple lists. You should consider either changing the representation of your doubly linked list, or save it into an array first, save the array with Marshal.to_string, and then do the reverse when unmarshaling.

Fixing this would require implementing another marshal/unmarshal couple, more expensive in memory, but without recursion on the stack.

@vicuna
Copy link
Author

vicuna commented Jul 21, 2011

Comment author: eugenz

Still, the same issue arises when outputting into/inputting from a file.

@vicuna
Copy link
Author

vicuna commented Jul 21, 2011

Comment author: @lefessan

Of course, Marshal.from/to_string share the C code with input/output_value, so all of them should trigger the same problem. You should consider saving the doubly linked list in an array first, before outputting it.

@vicuna
Copy link
Author

vicuna commented Jul 21, 2011

Comment author: eugenz

OK, thank you.

@vicuna
Copy link
Author

vicuna commented Dec 20, 2011

Comment author: @xavierleroy

Feature wish: a non-recursive implementation of byterun/extern.c, perhaps following the same pattern as byterun/compare.c.

@vicuna
Copy link
Author

vicuna commented Dec 20, 2011

Comment author: pascal_cuoq

I am relatively sure that the implementation of unmarshal for OCaml 3.12 available in http://frama-c.com/download/frama-c-Nitrogen-20111001.tar.gz (files external/un*.ml*) and documented at http://blog.frama-c.com/public/unmarshal.pdf does not have this issue.

@vicuna
Copy link
Author

vicuna commented Dec 20, 2011

Comment author: @xavierleroy

The problem here is with marshaling. But, yes, the unmarshaler in byterun/intern.c is also recursive and vulnerable to stack overflows.

@vicuna
Copy link
Author

vicuna commented Apr 23, 2012

Comment author: meyer

This has been fixed now (the recursion has been unrolled in both marshaller and un-marshaller).

Please see SVN trunk revisions: 12390, 12250, 12248 and 12247, and also merged into 4.0.

@vicuna
Copy link
Author

vicuna commented Apr 25, 2012

Comment author: meyer

Merged from trunk to 4.0 as SVN revisions r12392 and r12394.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant