Skip to content

v0.2.1 — memory-safety fixes

Choose a tag to compare

@s2x s2x released this 17 Aug 11:10
· 23 commits to main since this release

Recommended over 0.2.0, where reading an ARRAY column corrupts the heap.

Supports liblbug 0.19.x. No API changes.

Both bugs were found by probing whether ARRAY and UNION work at all — neither has anything to do with those types.

Heap corruption in the extension

Three error paths freed return_value without resetting it, so the engine freed the same array again. It reported as zend_mm_heap corrupted with no hint of the origin, and AddressSanitizer could not see it: the corruption lives inside Zend's own memory pool, which the sanitizer sees as a single allocation. Three sibling paths already had the reset — the pattern had just been applied inconsistently.

ValueReader ignored every lbug_state

liblbug leaves the out parameter untouched on failure, so an unchecked getter returned a plausible wrong value — a zeroed struct reads as an empty list — or, for the getters that yield an lbug_value, a garbage handle that segfaulted when read.

All 21 calls now check, throwing ConnectorException with the same messages the extension uses, so the same failure is catchable the same way on both backends. The extension had always checked them; this was a straight divergence between the two connectors that the shared suite never caught, because it only covered types that succeed.

ARRAY and UNION

A liblbug limitation, not a bug here: lbug_value_get_list_size() fails on a fixed-size array, and lbug_value_get_struct_field_value() fails on a union's second field. The values are intact, so both backends now fall back to liblbug's own rendering — the policy RECURSIVE_REL already used — rather than discarding reachable data:

$c->query('RETURN cast([1, 2, 3] AS INT64[3]) AS a')->fetchOne();                 // '[1,2,3]'
$c->query('RETURN cast(cast([1, 2, 3] AS INT64[3]) AS INT64[]) AS l')->fetchOne(); // [1, 2, 3]

Cast to a LIST in Cypher when you want structure.

Full notes in CHANGELOG.md.