Skip to content

Fix pointer offsets across realloc - #354

Open
Marti2203 wants to merge 1 commit into
yaml:masterfrom
Marti2203:fix/realloc-pointer-offsets
Open

Marti2203 wants to merge 1 commit into
yaml:masterfrom
Marti2203:fix/realloc-pointer-offsets

Conversation

@Marti2203

Copy link
Copy Markdown

This fixes undefined behavior in yaml_string_extend, yaml_stack_extend, and yaml_queue_extend.

After a successful realloc, pointers into the original allocation are invalid. The functions previously calculated sizes and offsets using those invalidated pointers after calling yaml_realloc.

The change calculates all required sizes and offsets before reallocating, then reconstructs the internal pointers relative to the new allocation.

Reproduction

The issue is detected with Clang’s pointer-pair sanitizer:

-fsanitize=address,pointer-subtract
ASAN_OPTIONS=detect_invalid_pointer_pairs=2:halt_on_error=1

Before the fix, extending a string reports:

  ERROR: AddressSanitizer: invalid-pointer-pair
      yaml_string_extend src/api.c

The same pattern existed in the stack and queue extension helpers.

Tests

Added test-realloc, which exercises:

  • String extension while preserving the current pointer offset.
  • Stack extension while preserving the top offset.
  • Queue extension while preserving head and tail offsets.

Verified with:

  • CMake test suite: 4/4 passed.
  • Autotools test suite: 4/4 passed.
  • ASan with pointer-pair detection enabled.
  • A public parser test using a long scalar that forces string reallocation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant