From: "peterzhu2118 (Peter Zhu) via ruby-core" <ruby-core@ml.ruby-lang.org>
To: ruby-core@ml.ruby-lang.org
Cc: "peterzhu2118 (Peter Zhu)" <noreply@ruby-lang.org>
Subject: [ruby-core:120223] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs
Date: Thu, 12 Dec 2024 19:14:01 +0000 (UTC) [thread overview]
Message-ID: <redmine.issue-20950.20241212191400.42491@ruby-lang.org> (raw)
In-Reply-To: <redmine.issue-20950.20241212191400.42491@ruby-lang.org>
Issue #20950 has been reported by peterzhu2118 (Peter Zhu).
----------------------------------------
Bug #20950: Use-after-free in ep in Proc#dup for ifunc procs
https://bugs.ruby-lang.org/issues/20950
* Author: peterzhu2118 (Peter Zhu)
* Status: Open
* Backport: 3.1: WONTFIX, 3.2: REQUIRED, 3.3: REQUIRED
----------------------------------------
GitHub PR: https://github.com/ruby/ruby/pull/12319
ifunc proc has the ep allocated in the data of the TypedData object. If an ifunc proc is duplicated, the ep points to the ep of the source object. If the source object is freed, then the ep of the duplicated object now points to a freed memory region. If we try to use the ep we could crash.
For example, the following script crashes:
```ruby
p = { a: 1 }.to_proc
100.times do
p = p.dup
GC.start
p.call
rescue ArgumentError
end
```
This commit changes ifunc proc to also duplicate the ep when it is duplicated.
--
https://bugs.ruby-lang.org/
______________________________________________
ruby-core mailing list -- ruby-core@ml.ruby-lang.org
To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/
next parent reply other threads:[~2024-12-12 19:14 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-12 19:14 peterzhu2118 (Peter Zhu) via ruby-core [this message]
2024-12-22 2:34 ` [ruby-core:120362] " nagachika (Tomoyuki Chikanaga) via ruby-core
2025-01-15 1:55 ` [ruby-core:120687] " k0kubun (Takashi Kokubun) via ruby-core
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=redmine.issue-20950.20241212191400.42491@ruby-lang.org \
--to=ruby-core@ml.ruby-lang.org \
--cc=noreply@ruby-lang.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).