Bug in pyembed_version_unsafe: Crash with unsafe malloc

[alexgobbo]

When switching to Python 3.5, Anaconda 2.4.1 , my application using embedded JEP started crashing systematically:

*** glibc detected *** /opt/gfa/java/latest/bin/java: free(): invalid next size (fast): 0x00007f68d0018ac0 ***
======= Backtrace: =========
/lib64/libc.so.6[0x320be75f3e]
/lib64/libc.so.6[0x320be78dd0]
/import/exchange/tmp/pshell/python/latest/lib/python3.5/site-packages/jep/libjep.so(pyembed_version_unsafe+0x1b8)[0x7f69c5022058]
/import/exchange/tmp/pshell/python/latest/lib/python3.5/site-packages/jep/libjep.so(pyembed_startup+0x15)[0x7f69c50220a5]
[0x7f69f9015994]

I noticed that if I change the contents of /lib/python3.5/version.txt from "Anaconda 2.4.1 (64-bit)" to any other, but having a different number of bytes, there is no crash.

I realized then the following bug in pyembed_version_unsafe, line 264, which may justify the problem: in order to strcpy, we should allocate strlen+1 bytes, so that:

version = malloc(sizeof(char) * strlen(pyversion));
strcpy(version, pyversion);

should be:

version = malloc(sizeof(char) * (strlen(pyversion)+1));
strcpy(version, pyversion);

[ndjensen]

Thanks for finding this and doing such an in-depth investigation! Since the release date of Jep 3.7 is somewhat undetermined at this time, I would like to fix this on the dev_3.6 branch and will make a new Jep 3.6 release soon. Your code analysis is good, did you test to verify that it does fix the problem?

Do you want to create a pull request with the fix or would you prefer that I just fix it?

[alexgobbo]

I am sorry, I did't recompile to test it as the bug seemed clear.
It is s a small thing so please just go ahead and fix it. If a problem persists I'll compile and debug it properly.

Thanks to you, for your great work.

[ndjensen]

@alexgobbo, I have updated the dev_3.6 branch. Please test it out and see if it works. I'd prefer to know your issue is fixed before I release a new version of 3.6.

[alexgobbo]

Yes, it fixed the problem!

Thanks.

[ndjensen]

Thank you for identifying the problem, providing a fix, and testing the fix. I am aiming to release a new Jep 3.6 in the near future.

[ndjensen]

Fixed in 3.6.4 and merged forward into dev_3.7.