Fix segfault if file descriptor unavailable#249
Conversation
The `get_java_var_long` function returns 0 in several failure modes, e.g. if a file descriptor is unavailable. [1] However, one of the call sites is missing the result check, which causes a JVM segfault if the return value is 0. The segfault occurs on dereferencing the pointer: [2] ```c eis->eventflags[SPE_DATA_AVAILABLE] ``` Add a result value check, throwing a proper IOException if it is 0. See also similar issue NeuronRobotics#59. [3] Fixes NeuronRobotics#112 [4], NeuronRobotics#136 [5] and NeuronRobotics#242 [6]. [1]: https://github.com/NeuronRobotics/nrjavaserial/blob/0df8b60485a56d7698b71183237b5615d02a8194/src/main/c/src/SerialImp.c#L5137-L5142 [2]: https://github.com/NeuronRobotics/nrjavaserial/blob/0df8b60485a56d7698b71183237b5615d02a8194/src/main/c/src/SerialImp.c#L3085 [3]: NeuronRobotics#59 [4]: NeuronRobotics#112 [5]: NeuronRobotics#136 [6]: NeuronRobotics#242 Reported-by: Alex Vasiliev <@alex-vas> Reported-by: Łukasz Dywicki <luke@code-house.org> Reported-by: Jose Pacelli <josepacelli@gmail.com> Reported-by: Frank Hartwig <frank.fr.hartwig@deutschebahn.com>
|
I can confirm that this fix is independent of PR #211. Both segfaults are easy to tell apart because they have unique fingerprints in the error log: The segfault being tackled here always occurs in Segfaults being addressed by PR #211 are occurring outside of |
|
Thank you for digging so deep into these issues. The check you're introducing here is perfectly sensible. What initially confused me was how this code is getting called at all with nrjavaserial/src/main/java/gnu/io/RXTXPort.java Lines 108 to 111 in 0df8b60 It looks like that happens when the event loop is shut down via nrjavaserial/src/main/c/src/SerialImp.c Line 4984 in 0df8b60 nrjavaserial/src/main/c/src/SerialImp.c Lines 4261 to 4268 in 0df8b60 The nrjavaserial/src/main/java/gnu/io/RXTXPort.java Lines 1482 to 1492 in 0df8b60 ...but because access to the I'll happily merge this fix now – thank you very much for the contribution. And I'll modify #211 to protect the |
The
get_java_var_longfunction returns 0 in several failure modes, e.g. if a file descriptor is unavailable.However, one of the call sites is missing the result check, which causes a JVM segfault if the return value is 0. The segfault occurs on dereferencing the pointer:
Add a result value check, throwing a proper IOException if it is 0.
See also similar issue #59.
Fixes #112, #136 and #242.