• source navigation  • diff markup  • identifier search  • freetext search  • 

Sources/ucode/tests/custom/99_bugs/55_zlib_read_method_use_after_free

  1 Test that `deflate()` and `inflate()` survive the user's `read()`
  2 callback reassigning `obj.read` between calls. The streaming path caches the read method as a borrowed pointer,
  3 and reassignment frees the original closure before the next iteration's
  4 deref.
  5 
  6 -- Testcase --
  7 {%
  8         import { deflate, inflate } from 'zlib';
  9 
 10         function make_streaming_reader(chunks) {
 11                 let idx = 0;
 12                 let obj = {};
 13                 obj.read = function(n) {
 14                         // state-machine pattern: first call swaps in the "real" reader
 15                         if (idx == 0) {
 16                                 obj.read = function(n) {
 17                                         return idx < length(chunks) ? chunks[idx++] : "";
 18                                 };
 19                         }
 20                         return idx < length(chunks) ? chunks[idx++] : "";
 21                 };
 22                 return obj;
 23         }
 24 
 25         let compressed = deflate(make_streaming_reader([ "hello, ", "world!" ]));
 26 
 27         // slice into 8-byte chunks so inflate() makes multiple read() calls
 28         let chunks = [];
 29         for (let i = 0; i < length(compressed); i += 8)
 30                 push(chunks, substr(compressed, i, 8));
 31 
 32         let r = inflate(make_streaming_reader(chunks));
 33         printf("%s\n", r);
 34 %}
 35 -- End --
 36 
 37 -- Expect stdout --
 38 hello, world!
 39 -- End --

This page was automatically generated by LXR 0.3.1.  •  OpenWrt