Tcl Source Code

View Ticket
Login
Ticket UUID: 1eb488b699d74e0f9d22ea5fc78aa41aa5a77a14
Title: double free when deleting namespace containing the origin routine for some imported routine
Type: Bug Created on: 2020-08-16 14:45:03
Submitter: pooryorick Assigned to: pooryorick
Subsystem: - New Builtin Commands Severity: Minor
Priority: 5 Medium Last modified: 2020-08-31 19:06:07
Status: Closed Closed by: pooryorick
Resolution: Fixed Closed on: 2020-08-31 19:06:07
Version: 8.7
Description:

In Tcl -DPURIFY --enable-symbols the following script results in a memory error:

namespace eval test_ns_export {
    namespace export cmd1
    proc cmd1 args {}
}
namespace eval test_ns_import {
    namespace import [namespace parent]::test_ns_export::cmd1
}
proc test_ns_export::cmd1 args {}
catch {namespace delete {*}[namespace children :: test_ns_export]}
return success

The issue is that TclCreateObjCommandInNs() stores in the table of routines for the namespace a pointer to the structure for the new routine, but does not increment the reference count. Eventually this results in the routine structure being freed a second second time.

User Comments:
pooryorick added on 2020-08-16 14:51:59:

Fixed in [08e3b17c955f062d].


jan.nijtmans added on 2020-08-28 15:22:39:

Apparently, this report is for Tcl 8.7.

Fix now merged to core-8-branch.