[Tarantool-patches] [PATCH 1/2] popen: fix access to freed memory after :close()

Alexander Turenko alexander.turenko at tarantool.org
Mon May 18 14:42:57 MSK 2020


popen_delete() always frees a handle memory even when it reports a
failure to send SIGKILL, see [1]. We should reflect this contract in
popen_handle:close() and mark the handle as closed despite
popen_delete() return value.

There are cases, when killpg() fails with EPERM on Mac OS, so
popen_delete() reports a failure. See [1] for more information.

[1]: 01657bfbb9b34997f20d27405226a9affdeeb520 ('popen: always free
resources in popen_delete()')

Fixes #4995
---
 src/lua/popen.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lua/popen.c b/src/lua/popen.c
index 0e930e91b..471964ee6 100644
--- a/src/lua/popen.c
+++ b/src/lua/popen.c
@@ -2258,11 +2258,11 @@ lbox_popen_close(struct lua_State *L)
 		return 1;
 	}
 
+	luaT_mark_popen_handle_closed(L, 1);
+
 	if (popen_delete(handle) != 0)
 		return luaT_push_nil_and_error(L);
 
-	luaT_mark_popen_handle_closed(L, 1);
-
 	lua_pushboolean(L, true);
 	return 1;
 }
-- 
2.25.0



More information about the Tarantool-patches mailing list