ilios 1.0.4 → 1.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4f2c920b53b519c07299b86d8c31c290d858609dfda93dcdec8b1e0b1dcd687
-  data.tar.gz: c6070d007f1bdef3ba96dd5a2b4620e174f42c5cce6d662452be21fb5d54693d
+  metadata.gz: 119d5f16f005dbc317d42110162895ac90b7acc12fad39b4c2b33d04587ceeb9
+  data.tar.gz: d2b9caed7e97e5592737654171e6a06dea5cdecf872f5827b2547c6c4a704dc4
 SHA512:
-  metadata.gz: d2a5d977c1ed2c756534697590f8affe5a93ded29a53225ff1f2b0ae41bce7ce9901a1310f5540fef037de53e3b3aff9fa5c073635d983f528558200bf38e6a7
-  data.tar.gz: 8456a5c214c9a61bc0fcb5fd0558ea3e24a1345c3e77e8c3f94e4d85f2f7497b74bb1f1a5e755181521005d0102c52db92a3af0aa610be72b87296a32edb224f
+  metadata.gz: 291ee870b21e87e4d33056f4f5a08c513904cb967786115a3d618bfd61943f561d31744b3554b87f069dcc59d308c52366788561d15d8ae7266f83cb1b865d65
+  data.tar.gz: a3517d6c2d4f746dd66234e02a96b084069128442ddab5ad2044995fcb5418bbebbdc7f6d2d0b5dc9eeefe654646c7a42af36ffd607aa40dd8208726d3c8cb36

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Change Log
 
+## 1.0.5
+
+- Fix use-after-free when re-binding a statement with in-flight async executions (#24)
+
 ## 1.0.4
 
 -  Fix macOS build failure with Apple Clang on macOS 26+ (#23)

data/ext/ilios/future.c

@@ -116,6 +116,10 @@ static void future_result_success_yield(CassandraFuture *cassandra_future)
                     cassandra_result_obj = CREATE_RESULT(cassandra_result);
                     cassandra_result->result = cass_future_get_result(cassandra_future->future);
                     cassandra_result->statement_obj = cassandra_future->statement_obj;
+                    // Hand over the executed CassStatement so Result#next_page
+                    // can reuse it and it gets freed exactly once.
+                    cassandra_result->executed_statement = cassandra_future->executed_statement;
+                    cassandra_future->executed_statement = NULL;
 
                     obj = cassandra_result_obj;
                 }
@@ -202,6 +206,7 @@ VALUE future_create(CassFuture *future, VALUE session, VALUE statement, future_k
     cassandra_future_obj = CREATE_FUTURE(cassandra_future);
     cassandra_future->kind = kind;
     cassandra_future->future = future;
+    cassandra_future->executed_statement = NULL;
     cassandra_future->session_obj = session;
     cassandra_future->statement_obj = statement;
     cassandra_future->proc_mutex = rb_mutex_new();
@@ -366,6 +371,11 @@ static void future_destroy(void *ptr)
     if (cassandra_future->future) {
         cass_future_free(cassandra_future->future);
     }
+    if (cassandra_future->executed_statement) {
+        // Safe even if the request is still in flight: the driver's request
+        // holds its own reference to the statement internals.
+        cass_statement_free(cassandra_future->executed_statement);
+    }
     uv_sem_destroy(&cassandra_future->sem);
     xfree(cassandra_future);
 }

data/ext/ilios/ilios.h

@@ -27,6 +27,12 @@ typedef enum {
   execute_async
 } future_kind;
 
+typedef enum {
+  idempotency_unset,
+  idempotency_false,
+  idempotency_true
+} statement_idempotency;
+
 typedef struct
 {
     CassCluster* cluster;
@@ -40,21 +46,36 @@ typedef struct
 
 typedef struct
 {
+    // Scratch statement used for validating values in Statement#bind.
+    // It is never handed to the driver: each execution gets its own
+    // CassStatement built from `prepared` and `bound_values`, because the
+    // driver encodes values asynchronously on its IO thread and re-binding
+    // an in-flight statement is a use-after-free (issue #12).
     CassStatement* statement;
     const CassPrepared* prepared;
     VALUE session_obj;
+    VALUE bound_values;
+    int page_size;
+    statement_idempotency idempotent;
 } CassandraStatement;
 
 typedef struct
 {
     const CassResult *result;
     CassFuture *future;
+    // The CassStatement this result was executed with (owned, freed on destroy).
+    // Not to be confused with statement_obj, the Ruby Statement object.
+    CassStatement *executed_statement;
     VALUE statement_obj;
 } CassandraResult;
 
 typedef struct
 {
     CassFuture *future;
+    // The CassStatement this future's execution was submitted with (owned,
+    // freed on destroy unless handed over to the result). Not to be confused
+    // with statement_obj, the Ruby Statement object.
+    CassStatement *executed_statement;
     future_kind kind;
 
     VALUE session_obj;
@@ -108,6 +129,7 @@ extern CassFuture *nogvl_session_execute(CassSession* session, CassStatement* st
 extern void nogvl_sem_wait(uv_sem_t *sem);
 
 extern void statement_default_config(CassandraStatement *cassandra_statement);
+extern CassStatement *statement_build_for_execution(CassandraStatement *cassandra_statement);
 extern void result_await(CassandraResult *cassandra_result);
 
 

data/ext/ilios/result.c

@@ -55,12 +55,17 @@ static VALUE result_next_page(VALUE self)
     GET_STATEMENT(cassandra_result->statement_obj, cassandra_statement);
     GET_SESSION(cassandra_statement->session_obj, cassandra_session);
 
-    cass_statement_set_paging_state(cassandra_statement->statement, cassandra_result->result);
+    // Reuse this result's own executed statement: it is not shared with other
+    // executions and its previous request has already completed, so setting
+    // the paging state cannot race with the driver's IO thread.
+    cass_statement_set_paging_state(cassandra_result->executed_statement, cassandra_result->result);
 
-    result_future = nogvl_session_execute(cassandra_session->session, cassandra_statement->statement);
+    result_future = nogvl_session_execute(cassandra_session->session, cassandra_result->executed_statement);
 
     cass_result_free(cassandra_result->result);
-    cass_future_free(cassandra_result->future);
+    if (cassandra_result->future) {
+        cass_future_free(cassandra_result->future);
+    }
     cassandra_result->result = NULL;
     cassandra_result->future = result_future;
 
@@ -245,6 +250,9 @@ static void result_destroy(void *ptr)
     if (cassandra_result->future) {
         cass_future_free(cassandra_result->future);
     }
+    if (cassandra_result->executed_statement) {
+        cass_statement_free(cassandra_result->executed_statement);
+    }
     xfree(cassandra_result);
 }
 

data/ext/ilios/session.c

@@ -85,13 +85,24 @@ static VALUE session_execute_async(VALUE self, VALUE statement)
 {
     CassandraSession *cassandra_session;
     CassandraStatement *cassandra_statement;
+    CassandraFuture *cassandra_future;
+    CassStatement *executed_statement;
     CassFuture *result_future;
+    VALUE future;
 
     GET_SESSION(self, cassandra_session);
     GET_STATEMENT(statement, cassandra_statement);
 
-    result_future = nogvl_session_execute(cassandra_session->session, cassandra_statement->statement);
-    return future_create(result_future, self, statement, execute_async);
+    // Execute a dedicated statement so that later re-binds of `statement`
+    // cannot race with the driver's asynchronous encoding (issue #12).
+    executed_statement = statement_build_for_execution(cassandra_statement);
+    result_future = nogvl_session_execute(cassandra_session->session, executed_statement);
+
+    future = future_create(result_future, self, statement, execute_async);
+    GET_FUTURE(future, cassandra_future);
+    // The future owns the executed statement and frees it on destroy.
+    cassandra_future->executed_statement = executed_statement;
+    return future;
 }
 
 /**
@@ -107,15 +118,18 @@ static VALUE session_execute(VALUE self, VALUE statement)
     CassandraSession *cassandra_session;
     CassandraStatement *cassandra_statement;
     CassandraResult *cassandra_result;
+    CassStatement *executed_statement;
     CassFuture *result_future;
     VALUE cassandra_result_obj;
 
     GET_SESSION(self, cassandra_session);
     GET_STATEMENT(statement, cassandra_statement);
 
-    result_future = nogvl_session_execute(cassandra_session->session, cassandra_statement->statement);
+    executed_statement = statement_build_for_execution(cassandra_statement);
+    result_future = nogvl_session_execute(cassandra_session->session, executed_statement);
 
     cassandra_result_obj = CREATE_RESULT(cassandra_result);
+    cassandra_result->executed_statement = executed_statement;
     cassandra_result->future = result_future;
     cassandra_result->statement_obj = statement;
 

data/ext/ilios/statement.c

@@ -17,14 +17,24 @@ const rb_data_type_t cassandra_statement_data_type = {
     RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED | RUBY_TYPED_FROZEN_SHAREABLE,
 };
 
+typedef struct
+{
+    const CassPrepared *prepared;
+    CassStatement *statement;
+    VALUE bound_values;
+} statement_bind_context;
+
 void statement_default_config(CassandraStatement *cassandra_statement)
 {
+    cassandra_statement->bound_values = Qnil;
+    cassandra_statement->page_size = DEFAULT_PAGE_SIZE;
+    cassandra_statement->idempotent = idempotency_unset;
     cass_statement_set_paging_size(cassandra_statement->statement, DEFAULT_PAGE_SIZE);
 }
 
-static int hash_cb(VALUE key, VALUE value, VALUE statement)
+static int hash_cb(VALUE key, VALUE value, VALUE arg)
 {
-    CassandraStatement *cassandra_statement = (CassandraStatement *)statement;
+    statement_bind_context *ctx = (statement_bind_context *)arg;
     const CassDataType* data_type;
     CassValueType value_type;
     CassError result;
@@ -35,14 +45,14 @@ static int hash_cb(VALUE key, VALUE value, VALUE statement)
     }
     name = StringValueCStr(key);
 
-    data_type = cass_prepared_parameter_data_type_by_name(cassandra_statement->prepared, name);
+    data_type = cass_prepared_parameter_data_type_by_name(ctx->prepared, name);
     if (data_type == NULL) {
         rb_raise(eStatementError, "Invalid name %s was given.", name);
     }
     value_type = cass_data_type_type(data_type);
 
     if (NIL_P(value)) {
-        result = cass_statement_bind_null_by_name(cassandra_statement->statement, name);
+        result = cass_statement_bind_null_by_name(ctx->statement, name);
         goto result_check;
     }
 
@@ -54,7 +64,7 @@ static int hash_cb(VALUE key, VALUE value, VALUE statement)
             if (v < INT8_MIN || v > INT8_MAX) {
                 rb_raise(rb_eRangeError, "Invalid value: %ld", v);
             }
-            result = cass_statement_bind_int8_by_name(cassandra_statement->statement, name, (cass_int8_t)v);
+            result = cass_statement_bind_int8_by_name(ctx->statement, name, (cass_int8_t)v);
         }
         break;
 
@@ -66,7 +76,7 @@ static int hash_cb(VALUE key, VALUE value, VALUE statement)
                 rb_raise(rb_eRangeError, "Invalid value: %ld", v);
             }
 
-            result = cass_statement_bind_int16_by_name(cassandra_statement->statement, name, (cass_int16_t)v);
+            result = cass_statement_bind_int16_by_name(ctx->statement, name, (cass_int16_t)v);
         }
         break;
 
@@ -78,12 +88,12 @@ static int hash_cb(VALUE key, VALUE value, VALUE statement)
                 rb_raise(rb_eRangeError, "Invalid value: %ld", v);
             }
 
-            result = cass_statement_bind_int32_by_name(cassandra_statement->statement, name, (cass_int32_t)v);
+            result = cass_statement_bind_int32_by_name(ctx->statement, name, (cass_int32_t)v);
         }
         break;
 
     case CASS_VALUE_TYPE_BIGINT:
-        result = cass_statement_bind_int64_by_name(cassandra_statement->statement, name, NUM2LONG(value));
+        result = cass_statement_bind_int64_by_name(ctx->statement, name, NUM2LONG(value));
         break;
 
     case CASS_VALUE_TYPE_FLOAT:
@@ -94,25 +104,25 @@ static int hash_cb(VALUE key, VALUE value, VALUE statement)
                 rb_raise(rb_eRangeError, "Invalid value: %lf", v);
             }
 
-            result = cass_statement_bind_float_by_name(cassandra_statement->statement, name, v);
+            result = cass_statement_bind_float_by_name(ctx->statement, name, v);
         }
         break;
 
     case CASS_VALUE_TYPE_DOUBLE:
-        result = cass_statement_bind_double_by_name(cassandra_statement->statement, name, NUM2DBL(value));
+        result = cass_statement_bind_double_by_name(ctx->statement, name, NUM2DBL(value));
         break;
 
     case CASS_VALUE_TYPE_BOOLEAN:
         {
             cass_bool_t v = RTEST(value) ? cass_true : cass_false;
-            result = cass_statement_bind_bool_by_name(cassandra_statement->statement, name, v);
+            result = cass_statement_bind_bool_by_name(ctx->statement, name, v);
         }
         break;
 
     case CASS_VALUE_TYPE_TEXT:
     case CASS_VALUE_TYPE_ASCII:
     case CASS_VALUE_TYPE_VARCHAR:
-        result = cass_statement_bind_string_by_name(cassandra_statement->statement, name, StringValueCStr(value));
+        result = cass_statement_bind_string_by_name(ctx->statement, name, StringValueCStr(value));
         break;
 
     case CASS_VALUE_TYPE_TIMESTAMP:
@@ -123,7 +133,7 @@ static int hash_cb(VALUE key, VALUE value, VALUE statement)
                 rb_raise(rb_eTypeError, "no implicit conversion of %"PRIsVALUE" to Time", rb_obj_class(value));
             }
         }
-        result = cass_statement_bind_int64_by_name(cassandra_statement->statement, name, (cass_int64_t)(NUM2DBL(rb_Float(value)) * 1000));
+        result = cass_statement_bind_int64_by_name(ctx->statement, name, (cass_int64_t)(NUM2DBL(rb_Float(value)) * 1000));
         break;
 
     case CASS_VALUE_TYPE_UUID:
@@ -132,7 +142,7 @@ static int hash_cb(VALUE key, VALUE value, VALUE statement)
             const char *uuid_string = StringValueCStr(value);
 
             cass_uuid_from_string(uuid_string, &uuid);
-            result = cass_statement_bind_uuid_by_name(cassandra_statement->statement, name, uuid);
+            result = cass_statement_bind_uuid_by_name(ctx->statement, name, uuid);
         }
         break;
 
@@ -145,9 +155,65 @@ result_check:
         rb_raise(eStatementError, "Failed to bind value: %s", cass_error_desc(result));
     }
 
+    if (!NIL_P(ctx->bound_values)) {
+        if (RB_TYPE_P(value, T_STRING)) {
+            // Snapshot the value so a later in-place mutation by the caller
+            // doesn't change what gets bound at execution time.
+            value = rb_str_new_frozen(value);
+        }
+        rb_hash_aset(ctx->bound_values, key, value);
+    }
+
     return ST_CONTINUE;
 }
 
+typedef struct
+{
+    statement_bind_context ctx;
+    VALUE hash;
+} statement_rebind_args;
+
+static VALUE statement_rebind_body(VALUE arg)
+{
+    statement_rebind_args *args = (statement_rebind_args *)arg;
+
+    rb_hash_foreach(args->hash, hash_cb, (VALUE)&args->ctx);
+    return Qnil;
+}
+
+/*
+ * Builds a fresh CassStatement carrying the current configuration and bound
+ * values for a single execution. The returned statement must not be mutated
+ * once handed to the driver, and the caller owns it: it must stay alive until
+ * the execution's future resolves and be freed exactly once afterwards.
+ */
+CassStatement *statement_build_for_execution(CassandraStatement *cassandra_statement)
+{
+    CassStatement *statement = cass_prepared_bind(cassandra_statement->prepared);
+
+    cass_statement_set_paging_size(statement, cassandra_statement->page_size);
+    if (cassandra_statement->idempotent != idempotency_unset) {
+        cass_statement_set_is_idempotent(statement, cassandra_statement->idempotent == idempotency_true ? cass_true : cass_false);
+    }
+
+    if (!NIL_P(cassandra_statement->bound_values)) {
+        statement_rebind_args args;
+        int state = 0;
+
+        args.ctx.prepared = cassandra_statement->prepared;
+        args.ctx.statement = statement;
+        args.ctx.bound_values = Qnil;
+        args.hash = cassandra_statement->bound_values;
+
+        rb_protect(statement_rebind_body, (VALUE)&args, &state);
+        if (state) {
+            cass_statement_free(statement);
+            rb_jump_tag(state);
+        }
+    }
+    return statement;
+}
+
 /**
  * Binds a specified column value to a query.
  * A hash object should be given with column name as key.
@@ -161,11 +227,27 @@ result_check:
 static VALUE statement_bind(VALUE self, VALUE hash)
 {
     CassandraStatement *cassandra_statement;
+    statement_bind_context ctx;
+    VALUE bound_values;
 
     Check_Type(hash, T_HASH);
     TypedData_Get_Struct(self, CassandraStatement, &cassandra_statement_data_type, cassandra_statement);
 
-    rb_hash_foreach(hash, hash_cb, (VALUE)cassandra_statement);
+    // Merge into a copy instead of mutating in place: the previous hash may be
+    // shared with a frozen (Ractor-shareable) statement or be iterated by an
+    // execution on another thread.
+    if (NIL_P(cassandra_statement->bound_values)) {
+        bound_values = rb_hash_new();
+    } else {
+        bound_values = rb_hash_dup(cassandra_statement->bound_values);
+    }
+    RB_OBJ_WRITE(self, &cassandra_statement->bound_values, bound_values);
+
+    ctx.prepared = cassandra_statement->prepared;
+    ctx.statement = cassandra_statement->statement;
+    ctx.bound_values = bound_values;
+
+    rb_hash_foreach(hash, hash_cb, (VALUE)&ctx);
     return self;
 }
 
@@ -180,7 +262,8 @@ static VALUE statement_page_size(VALUE self, VALUE page_size)
     CassandraStatement *cassandra_statement;
 
     GET_STATEMENT(self, cassandra_statement);
-    cass_statement_set_paging_size(cassandra_statement->statement, NUM2INT(page_size));
+    cassandra_statement->page_size = NUM2INT(page_size);
+    cass_statement_set_paging_size(cassandra_statement->statement, cassandra_statement->page_size);
     return self;
 }
 
@@ -197,7 +280,8 @@ static VALUE statement_idempotent(VALUE self, VALUE idempotent)
     CassandraStatement *cassandra_statement;
 
     GET_STATEMENT(self, cassandra_statement);
-    cass_statement_set_is_idempotent(cassandra_statement->statement, RTEST(idempotent) ? cass_true : cass_false);
+    cassandra_statement->idempotent = RTEST(idempotent) ? idempotency_true : idempotency_false;
+    cass_statement_set_is_idempotent(cassandra_statement->statement, cassandra_statement->idempotent == idempotency_true ? cass_true : cass_false);
     return self;
 }
 
@@ -205,6 +289,7 @@ static void statement_mark(void *ptr)
 {
     CassandraStatement *cassandra_statement = (CassandraStatement *)ptr;
     rb_gc_mark_movable(cassandra_statement->session_obj);
+    rb_gc_mark_movable(cassandra_statement->bound_values);
 }
 
 static void statement_destroy(void *ptr)
@@ -230,6 +315,7 @@ static void statement_compact(void *ptr)
     CassandraStatement *cassandra_statement = (CassandraStatement *)ptr;
 
     cassandra_statement->session_obj = rb_gc_location(cassandra_statement->session_obj);
+    cassandra_statement->bound_values = rb_gc_location(cassandra_statement->bound_values);
 }
 
 void Init_statement(void)

data/lib/ilios/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Ilios
-  VERSION = '1.0.4'
+  VERSION = '1.0.5'
   public_constant :VERSION
 
   CASSANDRA_CPP_DRIVER_VERSION = '2.17.1'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ilios
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.0.5
 platform: ruby
 authors:
 - Watson
@@ -58,7 +58,7 @@ metadata:
   homepage_uri: https://github.com/Watson1978/ilios
   source_code_uri: https://github.com/Watson1978/ilios
   bug_tracker_uri: https://github.com/Watson1978/ilios/issues
-  documentation_uri: https://www.rubydoc.info/gems/ilios/1.0.4
+  documentation_uri: https://www.rubydoc.info/gems/ilios/1.0.5
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: