{"action":"created","issue":{"url":"https://api.github.com/repos/cisco/ChezScheme/issues/77","repository_url":"https://api.github.com/repos/cisco/ChezScheme","labels_url":"https://api.github.com/repos/cisco/ChezScheme/issues/77/labels{/name}","comments_url":"https://api.github.com/repos/cisco/ChezScheme/issues/77/comments","events_url":"https://api.github.com/repos/cisco/ChezScheme/issues/77/events","html_url":"https://github.com/cisco/ChezScheme/issues/77","id":164595694,"number":77,"title":"Unguarded malloc in S_create_thread_object","user":{"login":"laqrix","id":82575,"avatar_url":"https://avatars.githubusercontent.com/u/82575?v=3","gravatar_id":"","url":"https://api.github.com/users/laqrix","html_url":"https://github.com/laqrix","followers_url":"https://api.github.com/users/laqrix/followers","following_url":"https://api.github.com/users/laqrix/following{/other_user}","gists_url":"https://api.github.com/users/laqrix/gists{/gist_id}","starred_url":"https://api.github.com/users/laqrix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/laqrix/subscriptions","organizations_url":"https://api.github.com/users/laqrix/orgs","repos_url":"https://api.github.com/users/laqrix/repos","events_url":"https://api.github.com/users/laqrix/events{/privacy}","received_events_url":"https://api.github.com/users/laqrix/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"akeep","id":113071,"avatar_url":"https://avatars.githubusercontent.com/u/113071?v=3","gravatar_id":"","url":"https://api.github.com/users/akeep","html_url":"https://github.com/akeep","followers_url":"https://api.github.com/users/akeep/followers","following_url":"https://api.github.com/users/akeep/following{/other_user}","gists_url":"https://api.github.com/users/akeep/gists{/gist_id}","starred_url":"https://api.github.com/users/akeep/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akeep/subscriptions","organizations_url":"https://api.github.com/users/akeep/orgs","repos_url":"https://api.github.com/users/akeep/repos","events_url":"https://api.github.com/users/akeep/events{/privacy}","received_events_url":"https://api.github.com/users/akeep/received_events","type":"User","site_admin":false},"assignees":[{"login":"akeep","id":113071,"avatar_url":"https://avatars.githubusercontent.com/u/113071?v=3","gravatar_id":"","url":"https://api.github.com/users/akeep","html_url":"https://github.com/akeep","followers_url":"https://api.github.com/users/akeep/followers","following_url":"https://api.github.com/users/akeep/following{/other_user}","gists_url":"https://api.github.com/users/akeep/gists{/gist_id}","starred_url":"https://api.github.com/users/akeep/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akeep/subscriptions","organizations_url":"https://api.github.com/users/akeep/orgs","repos_url":"https://api.github.com/users/akeep/repos","events_url":"https://api.github.com/users/akeep/events{/privacy}","received_events_url":"https://api.github.com/users/akeep/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2016-07-08T19:02:55Z","updated_at":"2016-07-17T17:49:13Z","closed_at":"2016-07-17T17:49:13Z","body":"Inside c/thread.c, the malloc of the tc structure is not checked.  I believe forking a large amount of threads in 32-bit mode should cause the malloc to fail, then the memcpy that follows to crash the system.\r\n\r\nBased on the notes above S_create_thread_object, it is not clear that the normal error handling procedures work here as they may allocate memory along the way.  The tc_mutex is also currently allocated and would likely not be released without special effort.\r\n\r\nCan the call sites adequately handle a malloc failure properly? Perhaps the caller should allocate the memory, and pass the resulting pointer into S_create_thread_object.  If it's NULL, then there's no need to copy.\r\n\r\nI haven't chased the details of vector_in or cons_in, but is it possible they can also return invalid values for thread creation?"},"comment":{"url":"https://api.github.com/repos/cisco/ChezScheme/issues/comments/233194351","html_url":"https://github.com/cisco/ChezScheme/issues/77#issuecomment-233194351","issue_url":"https://api.github.com/repos/cisco/ChezScheme/issues/77","id":233194351,"user":{"login":"akeep","id":113071,"avatar_url":"https://avatars.githubusercontent.com/u/113071?v=3","gravatar_id":"","url":"https://api.github.com/users/akeep","html_url":"https://github.com/akeep","followers_url":"https://api.github.com/users/akeep/followers","following_url":"https://api.github.com/users/akeep/following{/other_user}","gists_url":"https://api.github.com/users/akeep/gists{/gist_id}","starred_url":"https://api.github.com/users/akeep/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akeep/subscriptions","organizations_url":"https://api.github.com/users/akeep/orgs","repos_url":"https://api.github.com/users/akeep/repos","events_url":"https://api.github.com/users/akeep/events{/privacy}","received_events_url":"https://api.github.com/users/akeep/received_events","type":"User","site_admin":false},"created_at":"2016-07-17T17:49:13Z","updated_at":"2016-07-17T17:49:13Z","body":"The most recent commit fixes these three unchecked malloc locations, thanks for reporting the problem!"}}
{"actor":{"display_login":"akeep"}}