Running plugins in a sandbox

Question

I am designing a system in C/C++ which is extendible with all sort of plugins. There is a well defined C public API which mostly works with (const) char* and other pointer types. The plugins are compiled into .so or .dll files, and the main application loads them upon startup, and later unloads or reloads them upon request.

The plugins might come in from various sources, trustable or not so :)

Now, I would like to make sure, that if one plugin does something stupid (such as tries to free a memory which he was not supposed to free), this action does not bring down the entire system, but merely notices the main system about the misbehaving plugin for it in order to remove it from the queue.

The code calls are being done in the following manner:

const char* data = get_my_data();
for(int i = 0; i<plugins; i++)
{
   plugins[i]->execute(data);
}

but if plugin[0] frees "by accident" the data string or overwrites it or by mistake jumps to address 0x0 this would bring down the entire system, and I don't want this. How can I avoid this kind of catastrophe. (I know, I can duplicate the data string ... this does not solve my problem :) )

Answer 1

Make a wrapper process for plugin and communicate with that wrapper through IPC. In case of plugin failure your main process would be untouched