From 475b315a7a3bf140dccabd0a2ce6b77d3d3b0125 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Fri, 4 Dec 2020 13:56:53 +0900 Subject: [PATCH] skf_convert.i: avoid double free for rubyext With skf-2.10.14 and ruby 2.7.2p137, the following simple code: `ruby -I. -e 'require "skf" ; Skf.convert("-s", [164, 162].pack("C*"))'` causes double free, which does not occur on skf-2.10.12. With skf-2.10.14, in *convert(@SKFCSTRINGS@ *optstr, @SKFSTRINGS@ *cstr), the local value lwlstr is changed to be cleaned up by free() when returning from the function. On the other hand, with rubyext the input argument cstr is to be free'ed() in the same function (as same as in 2.10.12). But as with rubyext lwlstr points to cstr, this causes double free. Note that with perl or python extension, lwlstr is newly generated (allocated) using the original cstr. To avoid double free and to make rubyext behavior consistent with other extensions, lwlstr in convert() (and quickconvert, guess) must be newly allocated. --- skf_convert.i | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/skf_convert.i b/skf_convert.i index 113e845..1ff2522 100644 --- skf-2.10.14-a/skf_convert.i +++ skf-2.10.14-b/skf_convert.i @@ -1224,7 +1224,8 @@ static void r_skf_convert(struct Skf_localestring *lstr, long ibuflen, skf_script_init(); swig_state = 1; #if defined(SWIGRUBY) && (defined(SKF_RUBY19) || defined(SKF_RUBY2)) - lwlstr = cstr; + lwlstr = malloc(sizeof *lwlstr); + memcpy(lwlstr, cstr, sizeof *lwlstr); ibuflen = get_rstr_len(cstr); #elif defined(SWIGPYTHON) lwlstr = skf_pystring2skfstring(cstr,1); @@ -1349,7 +1350,8 @@ static void r_skf_convert(struct Skf_localestring *lstr, long ibuflen, debug_opt = 0; #if defined(SWIGRUBY) && (defined(SKF_RUBY19) || defined(SKF_RUBY2)) - lwlstr = cstr; + lwlstr = malloc(sizeof *lwlstr); + memcpy(lwlstr, cstr, sizeof *lwlstr); ibuflen = get_rstr_len(cstr); #elif defined(SWIGPYTHON) && defined(SKF_PYTHON3) lwlstr = skf_pystring2skfstring(cstr,1); @@ -1452,7 +1454,8 @@ static void r_skf_convert(struct Skf_localestring *lstr, long ibuflen, in_saved_codeset = -1; #if defined(SKF_RUBY19) || defined(SKF_RUBY2) - lwlstr = cstr; + lwlstr = malloc(sizeof *lwlstr); + memcpy(lwlstr, cstr, sizeof *lwlstr); ibuflen = get_rstr_len(cstr); #elif defined(SWIGPYTHON) && defined(SKF_PYTHON3) lwlstr = skf_pystring2skfstring(cstr,1); -- 2.28.0