Skip to content

Memory unsafety in withFilePath in 2.8.2.0 #295

Closed
Closed
Memory unsafety in withFilePath in 2.8.2.0#295
Labels
status: needs triagetype: bug

Description

@bgamari
bgamari
opened on Sep 13, 2023

Your environment

All.

Steps to reproduce

ghci> :set -XOverloadedStrings
ghci> import qualified Data.ByteString.Short as BSS
ghci> import Data.ByteString.Internal (c_strlen)
ghci> BSS.useAsCStringLen "ScriptEnv0.hs" $ \(ptr, len) -> c_strlen ptr >>= \clen -> print (clen, len)

Expected behaviour

(13,13)

Actual behaviour

ghci> :set -XOverloadedStrings
ghci> import qualified Data.ByteString.Short as BSS
ghci> import Data.ByteString.Internal (c_strlen)
ghci> BSS.useAsCStringLen "ScriptEnv0.hs" $ \(ptr, len) -> c_strlen ptr >>= \clen -> print (clen, len)
(13,13)
ghci> BSS.useAsCStringLen "ScriptEnv0.hs" $ \(ptr, len) -> c_strlen ptr >>= \clen -> print (clen, len)
(38,13)
ghci> BSS.useAsCStringLen "ScriptEnv0.hs" $ \(ptr, len) -> c_strlen ptr >>= \clen -> print (clen, len)
(29,13)
ghci> BSS.useAsCStringLen "ScriptEnv0.hs" $ \(ptr, len) -> c_strlen ptr >>= \clen -> print (clen, len)
(38,13)

This is due to https://github.com/haskell/unix/pull/279/files#diff-e155a859a7a42c152728c6296887607bcfe0a7b0213d98573053e137ed8ebb32R157, which incorrectly relies on strlen on a string produced with useCString. This was originally noted in haskell/cabal#9241.

Activity

  1. bgamari
    added
    status: needs triage
    type: bug
    on Sep 13, 2023

  2. bgamari commented on Sep 13, 2023

    @bgamari
    bgamari
    on Sep 13, 2023
    ContributorAuthor

    This is fixed in #294.

  3. gbaz commented on Sep 13, 2023

    @gbaz
    gbaz
    on Sep 13, 2023

    Should the bytestring documentation be updated to more clearly warn about this footgun with the useAsCStringLen function?

  4. hasufell commented on Sep 16, 2023

    @hasufell
    hasufell
    on Sep 16, 2023
    Member

    Fixed in #294

    @Bodigrim are you making the 2.8.2.1 release?

  5. hasufell
    closed this as completedon Sep 16, 2023

  6. Bodigrim commented on Sep 16, 2023

    @Bodigrim
    Bodigrim
    on Sep 16, 2023
    Contributor

    If you have a moment, please do, otherwise I'll release in the morning.

  7. hasufell commented on Sep 16, 2023

    @hasufell
    hasufell
    on Sep 16, 2023
    Member

    https://hackage.haskell.org/package/unix-2.8.2.1

  8. hasufell commented on Sep 16, 2023

    @hasufell
    hasufell
    on Sep 16, 2023
    Member

    @bgamari pushed tag for your submodules: https://github.com/haskell/unix/releases/tag/v2.8.2.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    status: needs triagetype: bug

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions