diff options
| author | Peter Zhu <[email protected]> | 2024-12-12 14:03:07 -0500 |
|---|---|---|
| committer | Peter Zhu <[email protected]> | 2024-12-13 10:10:03 -0500 |
| commit | 92dd9734a967c20e628c8f77c5ce700058dcd58c (patch) | |
| tree | e51b99d8cb385bba8be2f1ea158d4deb1f5afe51 /internal | |
| parent | 6cde41bc52cb411a3259349b23fab2cd05789b01 (diff) | |
Fix use-after-free in ep in Proc#dup for ifunc procs
[Bug #20950]
ifunc proc has the ep allocated in the cfunc_proc_t which is the data of
the TypedData object. If an ifunc proc is duplicated, the ep points to
the ep of the source object. If the source object is freed, then the ep
of the duplicated object now points to a freed memory region. If we try
to use the ep we could crash.
For example, the following script crashes:
p = { a: 1 }.to_proc
100.times do
p = p.dup
GC.start
p.call
rescue ArgumentError
end
This commit changes ifunc proc to also duplicate the ep when it is duplicated.
Notes
Notes:
Merged: https://github.com/ruby/ruby/pull/12319
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/proc.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/internal/proc.h b/internal/proc.h index c75f15b283..c6a9e38bfa 100644 --- a/internal/proc.h +++ b/internal/proc.h @@ -23,6 +23,7 @@ VALUE rb_block_to_s(VALUE self, const struct rb_block *block, const char *additi VALUE rb_callable_receiver(VALUE); VALUE rb_func_proc_new(rb_block_call_func_t func, VALUE val); +VALUE rb_func_proc_dup(VALUE src_obj); VALUE rb_func_lambda_new(rb_block_call_func_t func, VALUE val, int min_argc, int max_argc); VALUE rb_iseq_location(const struct rb_iseq_struct *iseq); VALUE rb_sym_to_proc(VALUE sym); |