Tcl Source Code

Tcl crashes when I setup a channel transformation on a non-blocking TCP client socket, and then remove it.

Here is the minimal reproducible example. A dummy echo server:

ncat -l -k -e /bin/cat --crlf 0.0.0.0 4400

And my Tcl script:

package require tcl::transform::observe

proc writable {sock} {
    chan event $sock writable {}
    chan configure $sock -translation {crlf binary} -blocking 0 -buffering full -encoding binary
    chan event $sock readable [list readable $sock]
    set ::status "connected"
}

proc readable {sock} {
    set readCount [chan gets $sock line]
    if {$readCount <= 0} {
        if {[eof $sock]} { 
            puts "Connection aborted"
            close $sock
            set :status "closed"
            break
        }
        # we don't have a full line yet - wait for next chan event
        return
    }
    set ::msg $line
}

set sock [socket -async localhost 4400]
chan event $sock writable [list writable $sock]
vwait ::status
puts "Status $status"
tcl::transform::observe $sock stdout ""

puts $sock "Hello\r\n"
flush $sock

vwait ::msg
puts "Got $msg"
# update ;#- avoids crash
chan pop $sock

after 100 {set ::forever 1}
vwait forever ;# crashes here

close $sock
puts DONE

This produces the following output:

Status connected
Hello

Got Hello
Segmentation fault (core dumped)

The lines "hello\r\n" are printed by the channel observer. Then Tcl crashes after I remove the channel transformation and enter the event loop.

The crash does NOT occur if I uncomment the line update ;#- avoids crash

The crash does NOT occur if I don't use the channel transformation.

I can reproduce the crash with 100% chance on OpenSUSE 15.4/Tcl 8.6.12 (from repos) and Windows/Tcl 8.6.13 (from Magicsplat).

Thanks in advance.

I've tried it on Windows using magicsplat, as well as the latest repository under debug and release modes, in a batch loop. Have not been able to get it to crash. (Using the Windows ncat from the nmap site).

Output is always

Status=connected
Hello1
Hello2
Connection aborted
Got closed
pending input before pop: 0
pending input after pop: 0
DONE

Note pending input is always 0. I just cannot get it to be non-0 which may be why my test does not crash. When I get time, I'll experiment different configs to try and get non-0 input.

BTW what version of tcllib are you using? I presume same as what shipped with the 8.6.13 magicsplat distribution?

Hello Harald, you need some 'echo' TCP server running on the port 4400. On Linux the easiest way is to run netcat as I show in the bug report. I'm not sure if netcat with the same features is available on Windows. You could write it in Tcl as well.

Although Tcl should never crash from anything you do at the scripting level, there are several problems with your code which I presume you have fixed in your script but updated the ticket.

In the readcount proc,

• there is a break outside of a loop which causes the event handler to abort. I presume that should be a return.
• the $readcount <= 0 check should be $readcount < 0 since getting back an empty line is perfectly kosher. In particular note your puts Hello\r\n is sending two newlines, one explicit and one because of the \r\n. So you will get back an empty line from the server.
• The set :status "closed" line is missing a : - should be ::status
• Moreover, strictly speaking you should also set ::msg in there in case the server closes without sending anything back (the vwait is waiting on ::msg)
• In case of EOF without receiving any lines, the handler closes the socket and the chan pop is attempted on a closed socket. Again this is only in the case the server closes without sending anything.

In any case, I could not reproduce the crash. With your script, I simply get Tcl exceptions, as expected. With my changes (see script below), I get a print out

Status connected
Hello
Connection aborted
Got closed
DONE

This is irrespective of whether the update is commented or not.

My script is below, please try and see if the crash is reproduced on your system with my script:

lappend auto_path d:/tcl/lib
package require tcl::transform::observe

proc writable {sock} {
    chan event $sock writable {}
    chan configure $sock -translation {crlf binary} -blocking 0 -buffering full -encoding binary
    chan event $sock readable [list readable $sock]
    set ::status "connected"
}

proc readable {sock} {
    set readCount [chan gets $sock line]
    if {$readCount < 0} {
        if {[eof $sock]} { 
            puts "Connection aborted"
            # close $sock
            chan event $sock readable {}
            set ::msg "closed"
            return
        }
        # we don't have a full line yet - wait for next chan event
        return
    }
    set ::msg $line
}

set sock [socket -async localhost 4400]
chan event $sock writable [list writable $sock]
vwait ::status
puts "Status $status"
tcl::transform::observe $sock stdout ""

puts $sock "Hello"
flush $sock

vwait ::msg
puts "Got $msg"
# update ;#- avoids crash
chan pop $sock

after 100 {set ::forever 1}
vwait forever ;# crashes here

close $sock
puts DONE