Mantis Bug Tracker

View Issue Details Jump to Notes ] Issue History ] Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0005942OCamlOCaml runtime systempublic2013-03-11 23:292013-03-12 00:03
Reporterbvaugon 
Assigned To 
PrioritynormalSeverityminorReproducibilityalways
StatusconfirmedResolutionopen 
PlatformOSOS Version
Product Version4.00.1 
Target VersionFixed in Version 
Summary0005942: Weak hash of serialized closures
DescriptionUsually, when you serialize a closure with one program, it is impossible to unserialize it with a different program, and you expect to obtain a runtime exception like: Failure("input_value: unknown code module FAE2E4BE7A3AE0091CF3043126B2CC65")

But, when two programs differs only by their data segments (see the attached example), it is possible to marshal a closure with the first program and to unmarshal it with the second program. Obviously, if you try to call the invalid unserialized closue, execution results in the famous "segmentation fault".

This bug is reproducible with ocamlc and ocamlopt.

The problem is that the hash sum stored in the marshalled closure is only computed with the code segment and not with the data segment.

I wrote a patch to fix it.
Steps To ReproduceWith attached x.ml and y.ml, run:

ocamlopt x.ml -o x
ocamlopt y.ml -o y
./x
Do not import "data", ok
./y
Segmentation fault (core dumped)

Additional InformationFixed by the attached patch: ocaml-4.00.1-data-marsh.diff.

Remark: dynlink is ok because the entire dynlinked files are hashed.
So, I just modify byterun and asmrun.
TagsNo tags attached.
Attached Filestgz file icon ocaml-4.00.1-data-marsh.tgz [^] (2,649 bytes) 2013-03-11 23:29
diff file icon ocaml-4.00.1-data-marsh.diff [^] (9,866 bytes) 2013-03-11 23:57 [Show Content]

- Relationships

-  Notes
(0008959)
gasche (developer)
2013-03-12 00:03
edited on: 2013-03-12 00:11

I took the liberty to upload the patch independently from the archive, for eventual reviewers that would be more comfortable having a look directly inside Mantis.

I could reproduce the bug with 3.12.1, 32 bits, but not 4.00.1 64 bits: as the data fields should be of the same size (or at least aligned), on a 64 bits machine you need to shorten the list in y.ml to two integers rather than four to observe the segfault.


- Issue History
Date Modified Username Field Change
2013-03-11 23:29 bvaugon New Issue
2013-03-11 23:29 bvaugon File Added: ocaml-4.00.1-data-marsh.tgz
2013-03-11 23:57 gasche File Added: ocaml-4.00.1-data-marsh.diff
2013-03-12 00:03 gasche Note Added: 0008959
2013-03-12 00:03 gasche Status new => confirmed
2013-03-12 00:11 gasche Note Edited: 0008959 View Revisions


Copyright © 2000 - 2011 MantisBT Group
Powered by Mantis Bugtracker