Tcl Source Code

If zlib is bumped into a client TCP channel in "compress" mode with -buffering none and -flush sync channel options, zlib code seems to crash Tcl on unexpected remote socket shutdowns, when the interpreter receives the SIGPIPE error from the socket subsystem.

Without zlib enabled, a "TCP client" script (expectedly) errors out with the "broken pipe" error, with zlib it SIGSEGVs whth this backtrace:

Program received signal SIGSEGV, Segmentation fault.
0xb7ea0f11 in Tcl_GetObjResult (interp=0x0)
    at /home/kostix/devel/tcl/generic/tclResult.c:570
570         if (*(iPtr->result) != 0) {
(gdb) bt
#0  0xb7ea0f11 in Tcl_GetObjResult (interp=0x0)
    at /home/kostix/devel/tcl/generic/tclResult.c:570
#1  0xb7ea1030 in Tcl_AppendResultVA (interp=0x0, 
    argList=0xbf81fa74 "��035>�)
    at /home/kostix/devel/tcl/generic/tclResult.c:617
#2  0xb7ea109f in Tcl_AppendResult (interp=0x0)
    at /home/kostix/devel/tcl/generic/tclResult.c:671
#3  0xb7ec242f in ChanClose (instanceData=0x9527418, interp=0x0)
    at /home/kostix/devel/tcl/generic/tclZlib.c:2239
#4  0xb7e5f3b4 in ChanClose (chanPtr=0x952b468, interp=0x0)
    at /home/kostix/devel/tcl/generic/tclIO.c:257
#5  0xb7e5f350 in TclFinalizeIOSubsystem ()
    at /home/kostix/devel/tcl/generic/tclIO.c:465
#6  0xb7e3b608 in Tcl_FinalizeThread ()
    at /home/kostix/devel/tcl/generic/tclEvent.c:1141
#7  0xb7e3b518 in Tcl_Finalize ()
    at /home/kostix/devel/tcl/generic/tclEvent.c:977
#8  0xb7e3b3e9 in Tcl_Exit (status=1)
    at /home/kostix/devel/tcl/generic/tclEvent.c:828
#9  0xb7deec31 in Tcl_ExitObjCmd (dummy=0x0, interp=0x95028e0, objc=2, 
    objv=0x950304c) at /home/kostix/devel/tcl/generic/tclCmdAH.c:789
#10 0xb7de037f in NRRunObjProc (data=0x9519374, interp=0x95028e0, result=0)
    at /home/kostix/devel/tcl/generic/tclBasic.c:4302
#11 0xb7de0110 in TclNRRunCallbacks (interp=0x95028e0, result=0, 
    rootPtr=0x9518f68, tebcCall=1)
    at /home/kostix/devel/tcl/generic/tclBasic.c:4240
#12 0xb7e3fd5f in TclExecuteByteCode (interp=0x95028e0, codePtr=0x952c688)
    at /home/kostix/devel/tcl/generic/tclExecute.c:2814
#13 0xb7de041e in NRCallTEBC (data=0x951956c, interp=0x95028e0, result=0)
    at /home/kostix/devel/tcl/generic/tclBasic.c:4324
#14 0xb7de0110 in TclNRRunCallbacks (interp=0x95028e0, result=0, rootPtr=0x0, 
    tebcCall=0) at /home/kostix/devel/tcl/generic/tclBasic.c:4240
#15 0xb7de22c6 in TclEvalObjEx (interp=0x95028e0, objPtr=0x0, flags=131072, 
    invoker=0x0, word=0) at /home/kostix/devel/tcl/generic/tclBasic.c:5716
#16 0xb7de224d in Tcl_EvalObjEx (interp=0x95028e0, objPtr=0x0, flags=131072)
    at /home/kostix/devel/tcl/generic/tclBasic.c:5697
#17 0xb7e7f021 in Tcl_Main (argc=-1, argv=0xbf820b70, 
    appInitProc=0x80486eb <Tcl_AppInit>)
    at /home/kostix/devel/tcl/generic/tclMain.c:579
#18 0x080486dc in main (argc=1404316, argv=0xb7d9d548)
    at /home/kostix/devel/tcl/unix/tclAppInit.c:87

I have attached the sample script that can be used to reproduce the crash.
One instance of it should be run as a server, like
$ tclsh8.6 zchanstack.tcl server
and the second on as a client, like
$ tclsh8.6 zchanstack.tcl client
The server code immediately closes the socket forcing the client to crash.

allow_comments - 1

Hmm, can only update the interpreter when the thread isn't exiting. Luckily, that's easy to achieve as there's an internal API to help.

I forgot to mention that the SIGPIPE error is generated as in the "reference" case, so the segmentation fault probably occurs in the code that is supposed to clean up the channel after errors or something like this.

File Added - 310606: zchanstack.tcl