[rpms/perl-grpc-xs] rawhide: Fix dereferencing arguments in Grpc::XS::Call->startBatch() subroutine

[rpms/perl-grpc-xs] rawhide: Fix dereferencing arguments in Grpc::XS::Call->startBatch() subroutine

[@ 2026-07-24 11:45 UTC (permalink / raw)]

A new commit has been pushed.

Repo   : rpms/perl-grpc-xs
Branch : rawhide
Commit : 5acc20ac8a72c789dda27fc12d7f1a28bafbea00
Author : Petr Písař <ppisar@redhat.com>
Date   : 2026-07-24T13:42:10+02:00
Stats  : +107/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/perl-grpc-xs/c/5acc20ac8a72c789dda27fc12d7f1a28bafbea00?branch=rawhide

Log:
Fix dereferencing arguments in Grpc::XS::Call->startBatch() subroutine

---
diff --git a/grpc-xs-0.38-Fix-dereferencing-hashes-in-Grpc-XS-Call-startBatch.patch b/grpc-xs-0.38-Fix-dereferencing-hashes-in-Grpc-XS-Call-startBatch.patch
new file mode 100644
index 0000000..fb9f7e7
--- /dev/null
+++ b/grpc-xs-0.38-Fix-dereferencing-hashes-in-Grpc-XS-Call-startBatch.patch
@@ -0,0 +1,99 @@
+From b49d52ec711e34bd077ba8ce410a2e16c9e241f4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Fri, 24 Jul 2026 12:59:00 +0200
+Subject: [PATCH] Fix dereferencing hashes in Grpc::XS::Call->startBatch()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Running t/15-xs_end_to_end.t under valgrind revealed reading
+unitialized memory:
+
+    $ valgrind -- perl -Iblib/{lib,arch} t/15-xs_end_to_end.t
+    ok 44 - status->details does not contain status:client_server_full_response_text
+    ==17367== Conditional jump or move depends on uninitialised value(s)
+    ==17367==    at 0x6ABC869: XS_Grpc__XS__Call_startBatch (call.xs:124)
+    ==17367==    by 0x4B42880: Perl_rpp_invoke_xs (inline.h:1176)
+    ==17367==    by 0x4B42880: Perl_pp_entersub (pp_hot.c:6558)
+    ==17367==    by 0x4BD223F: Perl_runops_standard (run.c:41)
+    ==17367==    by 0x4A91F46: S_run_body (perl.c:2884)
+    ==17367==    by 0x4A91F46: perl_run (perl.c:2799)
+    ==17367==    by 0x400135D: main (perlmain.c:127)
+    ==17367==
+    ok 45 - failed to trigger exception/testInvalidClientMessageArray
+    [...]
+    ok 50 - event->method has wrong value
+    ==17367== Conditional jump or move depends on uninitialised value(s)
+    ==17367==    at 0x6ABC1D4: create_metadata_array (util.c:200)
+    ==17367==    by 0x6ABCA71: XS_Grpc__XS__Call_startBatch (call.xs:168)
+    ==17367==    by 0x4B42880: Perl_rpp_invoke_xs (inline.h:1176)
+    ==17367==    by 0x4B42880: Perl_pp_entersub (pp_hot.c:6558)
+    ==17367==    by 0x4BD223F: Perl_runops_standard (run.c:41)
+    ==17367==    by 0x4A91BA1: S_run_body (perl.c:2879)
+    ==17367==    by 0x4A91BA1: perl_run (perl.c:2799)
+    ==17367==    by 0x400135D: main (perlmain.c:127)
+    ==17367==
+    Expected hash for create_metadata_array() args at t/15-xs_end_to_end.t line 298.
+    ok 51 - failed to trigger exception/testInvalidServerStatusMetadata
+    [...]
+
+The cause was an unconditional dereference followed by a type check:
+
+        case GRPC_OP_SEND_MESSAGE:
+          value = SvRV(value);
+→         if (SvTYPE(value)!=SVt_PVHV) {
+            croak("Expected a hash for send message");
+            goto cleanup;
+          }
+
+This bug was triggered by the test intentionally passing a string
+instead of a reference to a hash:
+
+      $event = $call->startBatch(
+	  Grpc::Constants::GRPC_OP_SEND_INITIAL_METADATA() => {},
+	  Grpc::Constants::GRPC_OP_SEND_CLOSE_FROM_CLIENT() => 1,
+→	  Grpc::Constants::GRPC_OP_SEND_MESSAGE() => 'invalid',
+      );
+
+This patch performs the dereference only if the subroutine argument is
+a reference. The same way was already used for
+GRPC_OP_SEND_STATUS_FROM_SERVER key type.
+---
+ ext/call.xs | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/ext/call.xs b/ext/call.xs
+index 3e10792..23a3ed2 100644
+--- a/ext/call.xs
++++ b/ext/call.xs
+@@ -104,7 +104,7 @@ startBatch(Grpc::XS::Call self, ...)
+ 
+       switch(atoi(SvPV_nolen(key))) {
+         case GRPC_OP_SEND_INITIAL_METADATA:
+-          value = SvRV(value);
++          if (SvROK(value)) value = SvRV(value);
+           if (SvTYPE(value)!=SVt_PVHV) {
+             croak("Expected a hash for GRPC_OP_SEND_INITIAL_METADATA");
+             goto cleanup;
+@@ -120,7 +120,7 @@ startBatch(Grpc::XS::Call self, ...)
+                metadata.metadata;
+           break;
+         case GRPC_OP_SEND_MESSAGE:
+-          value = SvRV(value);
++          if (SvROK(value)) value = SvRV(value);
+           if (SvTYPE(value)!=SVt_PVHV) {
+             croak("Expected a hash for send message");
+             goto cleanup;
+@@ -165,7 +165,8 @@ startBatch(Grpc::XS::Call self, ...)
+           if (hv_exists((HV*)value, "metadata", strlen("metadata"))) {
+             SV** inner_value;
+             inner_value = hv_fetchs((HV*)value, "metadata", 0);
+-            if (!create_metadata_array((HV*)SvRV(*inner_value), &trailing_metadata)) {
++            if (!SvROK(*inner_value) ||
++                !create_metadata_array((HV*)SvRV(*inner_value), &trailing_metadata)) {
+               croak("Bad trailing metadata value given");
+               goto cleanup;
+             }
+-- 
+2.55.0
+

diff --git a/perl-grpc-xs.spec b/perl-grpc-xs.spec
index cbacc99..2de3ea6 100644
--- a/perl-grpc-xs.spec
+++ b/perl-grpc-xs.spec
@@ -1,6 +1,6 @@
 Name:           perl-grpc-xs
 Version:        0.38
-Release:        12%{?dist}
+Release:        13%{?dist}
 Summary:        Perl binding to a client part of the gRPC library
 # examples/route_guide/route_guide.proto:   BSD-3-Clause
 # LICENSE:      Apache-2.0 text
@@ -8,6 +8,9 @@ Summary:        Perl binding to a client part of the gRPC library
 License:        Apache-2.0 AND (GPL-1.0-or-later OR Artistic-1.0-Perl) AND BSD-3-Clause
 URL:            https://metacpan.org/dist/grpc-xs
 Source0:        https://cpan.metacpan.org/authors/id/J/JO/JOYREX/grpc-xs-%{version}.tar.gz
+# Fix dereferencing arguments in Grpc::XS::Call->startBatch() subroutine,
+# proposed upstream, <https://github.com/joyrex2001/grpc-perl/pull/31>
+Patch1:         grpc-xs-0.38-Fix-dereferencing-hashes-in-Grpc-XS-Call-startBatch.patch
 BuildRequires:  coreutils
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -79,6 +82,7 @@ chmod +x %{buildroot}%{_libexecdir}/%{name}/test
 
 %check
 export HARNESS_OPTIONS=j$(perl -e 'if ($ARGV[0] =~ /.*-j([0-9][0-9]*).*/) {print $1} else {print 1}' -- '%{?_smp_mflags}')
+perl -Iblib/{lib,arch} t/15-xs_end_to_end.t
 make test
 
 %files
@@ -97,6 +101,9 @@ make test
 %{_libexecdir}/%{name}
 
 %changelog
+* Fri Jul 24 2026 Petr Pisar <ppisar@redhat.com> - 0.38-13
+- Fix dereferencing arguments in Grpc::XS::Call->startBatch() subroutine
+
 * Wed Jul 22 2026 Jitka Plesnikova <jplesnik@redhat.com> - 0.38-12
 - Perl 5.44 rebuild