[#120465] [Ruby master Bug#20998] rb_str_locktmp() changes flags of frozen strings and string literals — "Eregon (Benoit Daloze) via ruby-core" <ruby-core@...>
Issue #20998 has been reported by Eregon (Benoit Daloze).
17 messages
2025/01/03
[ruby-core:120687] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs
From:
"k0kubun (Takashi Kokubun) via ruby-core" <ruby-core@...>
Date:
2025-01-15 01:55:11 UTC
List:
ruby-core #120687
Issue #20950 has been updated by k0kubun (Takashi Kokubun).
Backport changed from 3.1: WONTFIX, 3.2: REQUIRED, 3.3: REQUIRED to 3.1: WONTFIX, 3.2: REQUIRED, 3.3: DONE
ruby_3_3 commit:299455be9966c0a31dabe00014a4b8fae5093a7d merged revision(s) commit:92dd9734a967c20e628c8f77c5ce700058dcd58c.
----------------------------------------
Bug #20950: Use-after-free in ep in Proc#dup for ifunc procs
https://bugs.ruby-lang.org/issues/20950#change-111510
* Author: peterzhu2118 (Peter Zhu)
* Status: Closed
* Backport: 3.1: WONTFIX, 3.2: REQUIRED, 3.3: DONE
----------------------------------------
GitHub PR: https://github.com/ruby/ruby/pull/12319
ifunc proc has the ep allocated in the data of the TypedData object. If an ifunc proc is duplicated, the ep points to the ep of the source object. If the source object is freed, then the ep of the duplicated object now points to a freed memory region. If we try to use the ep we could crash.
For example, the following script crashes:
```ruby
p = { a: 1 }.to_proc
100.times do
p = p.dup
GC.start
p.call
rescue ArgumentError
end
```
This commit changes ifunc proc to also duplicate the ep when it is duplicated.
--
https://bugs.ruby-lang.org/
______________________________________________
ruby-core mailing list -- [email protected]
To unsubscribe send an email to [email protected]
ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/