Using the marshal module the application crashes in some situations.
Example
import std/marshal
type ImageSetting = object
filename, name: string
a, b, c: float32
type Settings = object
last_uri: string
images: seq[ImageSetting]
var settings: Settings
# it only crashes when last_uri is at least 40 characters long
settings = to[Settings]("""{
"last_uri": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"images": [
{
"name": ""
}
]
}""")
echo settings
This is the smallest I've been able to make an example that crashes before even doing anything with it. If we remove anything, it seems to work until you use the data (with the last echo) when it does crash trying to access a string.
Actual Output
Traceback (most recent call last)
[...]/main.nim(16) main
[...]/nimskull/lib/pure/marshal.nim(339) to
[...]/nimskull/lib/pure/marshal.nim(269) loadAny
[...]/nimskull/lib/pure/marshal.nim(189) loadAny
[...]/nimskull/lib/pure/marshal.nim(174) loadAny
[...]/nimskull/lib/pure/marshal.nim(189) loadAny
[...]/nimskull/lib/pure/marshal.nim(236) loadAny
[...]/nimskull/lib/core/typeinfo.nim(605) setString
SIGSEGV: Illegal storage access. (Attempt to read from nil?)
And if we do something like removing a float or shortening the string:
Traceback (most recent call last)
[...]/src/main.nim(25) main
[...]/nimskull/lib/system/dollars.nim(104) $
[...]/nimskull/lib/system.nim(2848) addQuoted
[...]/nimskull/lib/system/dollars.nim(146) $
[...]/nimskull/lib/system/dollars.nim(116) collectionToString
[...]/nimskull/lib/system.nim(2848) addQuoted
[...]/nimskull/lib/system/dollars.nim(104) $
[...]/nimskull/lib/system.nim(2828) addQuoted
SIGSEGV: Illegal storage access. (Attempt to read from nil?)
Printing some info in setString suggests that the string "name" is being overwritten with "xxxxxxxxxxxxxxxx", so both the length and the address of the payload become 8680820740569200760.
The problem is with the content of the freshly-allocated sequence not being zeroed, resulting in a segmentation fault when a string is assigned to a location therein.
Specification
Using the marshal module the application crashes in some situations.
Example
This is the smallest I've been able to make an example that crashes before even doing anything with it. If we remove anything, it seems to work until you use the data (with the last echo) when it does crash trying to access a string.
Actual Output
And if we do something like removing a float or shortening the string:
Expected Output
Possible Solution
Printing some info in
setString
suggests that the string "name" is being overwritten with "xxxxxxxxxxxxxxxx", so both the length and the address of the payload become 8680820740569200760.Additional information
Using Linux x86_64, all default settings.