Re: use after free in python notmuch2 bindings

[David Bremner]

David Bremner  writes:

> I've been attempting to port nmweb to the new bindings, but I got stuck
> on a bug that segfaults python. I attached a reduced version that
> reproduces the problem for me. It uses recent messages from the notmuch
> list; it others can't reproduce let me know and I will try to make
> something more self contained including a message set.
>

Attached is a slightly simpler (and more informative) reproducer

It produces the the following output for me

7f23164b6cd0 
   87fsqijx7u@metapensiero.it 
 7f23164b6a90 
   87lf0anoiv@tethera.net 
 7f23164b6910 
   87bl16jezh@metapensiero.it 
 7f23164c3070 
   87bl0vlbys@powell.devork.be 
 7f23164c30d0 
   87lf0anoiv@tethera.net 
 7f23164b68e0 
   87bl16jezh@metapensiero.it 
 7f23164b6a00 
   87bl0vlbys@powell.devork.be 
zsh: IOT instruction  python3 test.py

The IOT instruction is actually talloc aborting. If I leave in the call
to msg.header, it segfaults as before.

I noticed that the message struct 0x139b8e0 is visited twice, once as
part of the thread and once as part of reply-to-reply-to-reply.

I think the issue here is that bindings destroy the iterator for
replies, but the library docs say

"
 * The returned list will be destroyed when the thread is
 * destroyed.
"

Perhaps that needs to be worded more strongly, to forbid the user from
calling notmuch_messages_destroy. I still need to untangle the intended
ownership semantics to be sure.

from notmuch2 import Database

def show_msgs(msgs, level):
print('{:s} {:x} {:s}'.format(' ' * level*4, id(msgs), str(msgs)))
for msg in msgs:
print('{:s} {:s} {:s}'.format(' ' * (level*4+2), msg.messageid, str(msg._msg_p)))
replies=msg.replies()
show_msgs(replies, level+1)


db = Database(config=Database.CONFIG.SEARCH)
msg=db.find("87fsqijx7u@metapensiero.it")
threads = db.threads(query="thread:"+msg.threadid)
thread = next (threads)

show_msgs(thread, 0)
___
notmuch mailing list -- notmuch@notmuchmail.org
To unsubscribe send an email to notmuch-le...@notmuchmail.org

use after free in python notmuch2 bindings

[David Bremner]

I've been attempting to port nmweb to the new bindings, but I got stuck
on a bug that segfaults python. I attached a reduced version that
reproduces the problem for me. It uses recent messages from the notmuch
list; it others can't reproduce let me know and I will try to make
something more self contained including a message set.

It's a bit tricky to get ASAN working but I managed with

% env ASAN_OPTIONS=alloc_dealloc_mismatch=0 LD_PRELOAD="libasan.so.6 
libstdc++.so.6" LD_LIBRARY_PATH=../../lib python3 ~/test.py

You can see in the attached output that one of the notmuch messages
structs is used after being freed. I suspect it has something to do with
the iterator code in the bindings, but I have not examined it in detail.

from notmuch2 import Database

def mailto_addrs(msg,header_name):
hdr = msg.header(header_name)
return 

def show_msgs(msgs):
  print("show msgs" + str(msgs))
  for msg in msgs:
  print("\t",msg.messageid)
  frm = mailto_addrs(msg,'From')
  rs = show_msgs(msg.replies())
  return 

db = Database(config=Database.CONFIG.SEARCH)
msg=db.find("87fsqijx7u@metapensiero.it")
threads = db.threads(query="thread:"+msg.threadid)
thread = next (threads)

show_msgs(thread)


asan.out
Description: Binary data
___
notmuch mailing list -- notmuch@notmuchmail.org
To unsubscribe send an email to notmuch-le...@notmuchmail.org