[tarantool-patches] [PATCH 1/1] swim: do not return raw member tt_uuid pointer

[tarantool-patches] [PATCH 1/1] swim: do not return raw member tt_uuid pointer

[Vladislav Shpilevoy]

When a member is deleted, pointer at its struct tt_uuid becomes
invalid. This commit makes member:uuid() create a new tt_uuid
object, cached for subsequent calls.
---
Branch: https://github.com/tarantool/tarantool/tree/gerold103/swim-member-use-after-free

 src/lua/swim.lua        | 10 +++++++++-
 test/swim/swim.result   |  4 ++++
 test/swim/swim.test.lua |  1 +
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/lua/swim.lua b/src/lua/swim.lua
index 4893d5767..adb102d06 100644
--- a/src/lua/swim.lua
+++ b/src/lua/swim.lua
@@ -391,7 +391,15 @@ end
 -- metatable, serialization, string conversions etc.
 --
 local function swim_member_uuid(m)
-    return capi.swim_member_uuid(swim_check_member(m, 'member:uuid()'))
+    local ptr = swim_check_member(m, 'member:uuid()')
+    local u = m.u
+    if not u then
+        ptr = capi.swim_member_uuid(ptr)
+        u = ffi.new('struct tt_uuid')
+        ffi.copy(u, ptr, ffi.sizeof('struct tt_uuid'))
+        rawset(m, 'u', u)
+    end
+    return u
 end
 
 local function swim_member_serialize(m)
diff --git a/test/swim/swim.result b/test/swim/swim.result
index 436d4e579..5696d984b 100644
--- a/test/swim/swim.result
+++ b/test/swim/swim.result
@@ -403,6 +403,10 @@ s:uuid()
 ---
 - 00000000-0000-1000-8000-000000000001
 ...
+s:uuid() == s:uuid()
+---
+- true
+...
 s:uri()
 ---
 - 127.0.0.1:<port>
diff --git a/test/swim/swim.test.lua b/test/swim/swim.test.lua
index a3eac9b46..44376e3db 100644
--- a/test/swim/swim.test.lua
+++ b/test/swim/swim.test.lua
@@ -137,6 +137,7 @@ s = s1:self()
 s
 s:status()
 s:uuid()
+s:uuid() == s:uuid()
 s:uri()
 s:incarnation()
 s:payload_cdata()
-- 
2.20.1 (Apple Git-117)

[tarantool-patches] Re: [PATCH 1/1] swim: do not return raw member tt_uuid pointer

[Konstantin Osipov]

* Vladislav Shpilevoy <v.shpilevoy@tarantool.org> [19/06/03 14:34]:
> When a member is deleted, pointer at its struct tt_uuid becomes
> invalid. This commit makes member:uuid() create a new tt_uuid
> object, cached for subsequent calls.

lgtm.



-- 
Konstantin Osipov, Moscow, Russia

[tarantool-patches] Re: [PATCH 1/1] swim: do not return raw member tt_uuid pointer

[Vladislav Shpilevoy]

Pushed to the master.

On 08/06/2019 17:09, Konstantin Osipov wrote:
> * Vladislav Shpilevoy <v.shpilevoy@tarantool.org> [19/06/03 14:34]:
>> When a member is deleted, pointer at its struct tt_uuid becomes
>> invalid. This commit makes member:uuid() create a new tt_uuid
>> object, cached for subsequent calls.
> 
> lgtm.
> 
> 
>