Skip to content

Segfault due to unchecked return value #1107

@smithzvk

Description

@smithzvk

closure = ffi_closure_alloc(sizeof(ffi_closure), &code);

I think I traced a segfault to this line. The return type stored in closure can be NULL on allocation failure. ffi_prep_closure_loc assumes that the value is valid, so passing NULL will produce a seg fault.

This happens on locked down systems with restricted execution and write permissions. The libffi closure API requires either trivially executable heap allocations or a location to mmap with both read-write and exec permissions. If it doesn't have this (e.g. selinux with no rw, exec mounts), it will fail to allocate the closure structure.

Perhaps this could fail more gracefully?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions