archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-15 13:39:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fix use-after-free in ep in Proc#dup for ifunc procs

Browse source 
[Bug #20950]

ifunc proc has the ep allocated in the cfunc_proc_t which is the data of
the TypedData object. If an ifunc proc is duplicated, the ep points to
the ep of the source object. If the source object is freed, then the ep
of the duplicated object now points to a freed memory region. If we try
to use the ep we could crash.

For example, the following script crashes:

    p = { a: 1 }.to_proc
    100.times do
      p = p.dup
      GC.start
      p.call
    rescue ArgumentError
    end

This commit changes ifunc proc to also duplicate the ep when it is duplicated.
This commit is contained in:
Peter Zhu 2024-12-12 14:03:07 -05:00
parent 6cde41bc52
commit 92dd9734a9
Notes: git 2024-12-13 15:10:20 +00:00
4 changed files with 63 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
vm.c
View file

@ -1198,7 +1198,16 @@ rb_proc_dup(VALUE self)
rb_proc_t *src;
GetProcPtr(self, src);
procval = proc_create(rb_obj_class(self), &src->block, src->is_from_method, src->is_lambda);
switch (vm_block_type(&src->block)) {
case block_type_ifunc:
procval = rb_func_proc_dup(self);
break;
default:
procval = proc_create(rb_obj_class(self), &src->block, src->is_from_method, src->is_lambda);
break;
}
if (RB_OBJ_SHAREABLE_P(self)) FL_SET_RAW(procval, RUBY_FL_SHAREABLE);
RB_GC_GUARD(self); /* for: body = rb_proc_dup(body) */
return procval;