Skip to content

Fix invalid free of static longjmp scratch buffer - #55

Open
aspeer wants to merge 1 commit into
6over3:mainfrom
aspeer:codex/fix-longjmp-static-buffer
Open

aspeer wants to merge 1 commit into
6over3:mainfrom
aspeer:codex/fix-longjmp-static-buffer

Conversation

@aspeer

@aspeer aspeer commented Sep 6, 2026

Copy link
Copy Markdown

I have forked the zeroperl repo to support a WASM build of my WebDyne framework. During that build I saw repeated traps in the Cloudflare WASM provider which were traced to an invalid free.

This PR seeks to fix that issue.

When a captured setjmp resumes after longjmp, _asyncjmp_setjmp_internal
passes longjmp_buf_ptr to free(). _asyncjmp_longjmp points that field at
its static tmp_longjmp_buf, so recovery attempts to free non-heap storage.
Clear the pointer instead. The capture buffer size and Asyncify ABI are unchanged.

Adds a native AddressSanitizer regression that includes the production state
machine and exercises capture followed by 100 longjmp recovery cycles.

Validation on macOS arm64 with Apple clang version 21.0.0 (clang-2100.1.1.101):

  • Untouched upstream: AddressSanitizer reports a bad free of
    _asyncjmp_longjmp.tmp_longjmp_buf on the first recovery.
  • Patched: all 100 recovery cycles pass under AddressSanitizer.
  • git diff --check passes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant