Crash rendering markdown

[mdiep]

Report

Crash rendering markdown

What did you do?

This Swift snippet crashes:

		let string = """
[I][s]

[s]: http://a.com
"""
		let down = try? string.toHTML()

I tried running this as a cmark test and it appears to work there, so I'm a bit confused. It definitely looks like a cmark bug, but I haven't dug in enough yet to be sure.

What did you expect to happen?

Markdown should render

What happened instead?

[cmark] calloc returned null pointer, aborting
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff67fdc23e libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fff68092c1c libsystem_pthread.dylib`pthread_kill + 285
    frame #2: 0x00007fff67f451c9 libsystem_c.dylib`abort + 127
  * frame #3: 0x0000000108254843 Down`xcalloc(nmem=4485853872, size=4485824064) at cmark.c:17
    frame #4: 0x000000010825b3f2 Down`cmark_chunk_free(mem=0x000000010829b080, c=0x000000010b603e40) at chunk.h:23
    frame #5: 0x000000010825b310 Down`reference_free(map=0x000000010b6192c0, ref=0x000000010b603e30) at references.c:21
    frame #6: 0x000000010825b25a Down`cmark_reference_map_free(map=0x000000010b6192c0) at references.c:133
    frame #7: 0x0000000108255650 Down`cmark_parser_free(parser=0x000000010b6088a0) at blocks.c:119
    frame #8: 0x0000000108255ccd Down`cmark_parse_document(buffer=…, len=586, options=0) at blocks.c:520
    frame #9: 0x0000000108267960 Down`closure #1 in static DownASTRenderer.stringToAST($0=0x000000010b608650, tree=nil, options=(rawValue = 0)) at DownASTRenderable.swift:59
    frame #10: 0x00000001082679b1 Down`partial apply for closure #1 in static DownASTRenderer.stringToAST(_:options:) at <compiler-generated>:0
    frame #11: 0x00000001082679d6 Down`thunk for @callee_guaranteed (@unowned UnsafePointer<Int8>) -> (@error @owned Error) at <compiler-generated>:0
    frame #12: 0x0000000108267a5b Down`partial apply for thunk for @callee_guaranteed (@unowned UnsafePointer<Int8>) -> (@error @owned Error) at <compiler-generated>:0
    frame #13: 0x0000000108512108 libswiftCore.dylib`Swift.String.withCString<A>((Swift.UnsafePointer<Swift.Int8>) throws -> A) throws -> A + 56
    frame #14: 0x00000001082677aa Down`static DownASTRenderer.stringToAST(string=…, options=(rawValue = 0), self=Down.DownASTRenderer) at DownASTRenderable.swift:57
    frame #15: 0x00000001082644b9 Down`String.toHTML(options=(rawValue = 0), self=…) at String+ToHTML.swift:24
    frame #16: 0x0000000101e16d60 DownTests`StringTests.testStringToHTML2(self=0x0000000101c0b7e0) at StringTests.swift:41
    frame #17: 0x0000000101e170a4 DownTests`@objc StringTests.testStringToHTML2() at <compiler-generated>:0

[phoney]

I spent some time investigating this today. You'll notice that cmark_chunk_free() doesn't call xcalloc() and that's the proximate cause of the crash.

Without going through all the details there is a missing #include in the cmark file parser.h. It should look like this

#include <stdio.h>
#include "references.h"
#include "node.h"
#include "buffer.h"
#include "memory.h"

references.h is missing. When added in that order this crash goes away.

[iwasrobbed]

I'm happy to accept pull requests, but prefer they be made upstream into https://github.com/commonmark/cmark

[phoney]

They already fixed this based on my issue filed there. There's no real way for me to tell when they might have a new versioned release and I think it's been over a year since their 0.28.3 version. We can either add this one change in our source base or pull the latest code from their HEAD. I can make a PR either way in the next few days. I would probably recommend pulling their latest code.

See also
https://talk.commonmark.org/t/when-do-you-think-well-ship-1-0-of-the-commonmark-spec/2797

[iwasrobbed]

@phoney I'd rather patch the 0.28.3 version for now in this repo and anyone is welcome to create a branch based off the HEAD of cmark if they want to live a little closer to the edge

Stability is really important since many people are using this in production so I want to ensure we're tracking to the stable releases of cmark.

[iwasrobbed]

fixed in #129