diff options
author | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-08-26 16:09:14 +0000 |
---|---|---|
committer | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-08-26 16:09:14 +0000 |
commit | b49b1d76d116c4262819a86ca51cb6df19304b9f (patch) | |
tree | 96aa52f6073adcf13f2747b0f5685db34044ec51 | |
parent | 689a6a0a763517e5fa1fc078b2f8130e0af7c4c0 (diff) |
merge revision(s) 9dec4e8fc3a6018261834b5ac9b9877f787b97ca: [Backport #15934]
String#b: Don't depend on dependent string
Registering a string that depend on a dependent string as fstring
can lead to use-after-free. See c06ddfe and 3f95620 for details.
The following script triggers use-after-free on trunk, 2.4.6, 2.5.5
and 2.6.3. Credits to @wanabe for using eval as a cross-version way
of registering a fstring.
```ruby
a = ('j' * 24).b.b
eval('', binding, a)
p a
4.times { GC.start }
p a
```
- string.c (str_replace_shared_without_enc): when given a
dependent string, depend on the root of the dependent
string.
[Bug #15934]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67767 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r-- | string.c | 20 | ||||
-rw-r--r-- | test/ruby/test_string.rb | 8 | ||||
-rw-r--r-- | version.h | 2 |
3 files changed, 26 insertions, 4 deletions
@@ -1127,12 +1127,26 @@ str_replace_shared_without_enc(VALUE str2, VALUE str) TERM_FILL(ptr2+len, termlen); } else { - str = rb_str_new_frozen(str); + VALUE root; + if (STR_SHARED_P(str)) { + root = RSTRING(str)->as.heap.aux.shared; + RSTRING_GETMEM(str, ptr, len); + } + else { + root = rb_str_new_frozen(str); + RSTRING_GETMEM(root, ptr, len); + } + if (!STR_EMBED_P(str2) && !FL_TEST_RAW(str2, STR_SHARED|STR_NOFREE)) { + /* TODO: check if str2 is a shared root */ + char *ptr2 = STR_HEAP_PTR(str2); + if (ptr2 != ptr) { + ruby_sized_xfree(ptr2, STR_HEAP_SIZE(str2)); + } + } FL_SET(str2, STR_NOEMBED); - RSTRING_GETMEM(str, ptr, len); RSTRING(str2)->as.heap.len = len; RSTRING(str2)->as.heap.ptr = ptr; - STR_SET_SHARED(str2, str); + STR_SET_SHARED(str2, root); } return str2; } diff --git a/test/ruby/test_string.rb b/test/ruby/test_string.rb index d4303e87c1..ae5b22c19e 100644 --- a/test/ruby/test_string.rb +++ b/test/ruby/test_string.rb @@ -2930,6 +2930,14 @@ CODE assert_equal(('a' * 24), a, '[Bug #15792]') end + def test_nesting_shared_b + a = ('j' * 24).b.b + eval('', binding, a) + assert_equal(('j' * 24), a) + 4.times { GC.start } + assert_equal(('j' * 24), a, '[Bug #15934]') + end + def test_shared_force_encoding s = "\u{3066}\u{3059}\u{3068}".gsub(//, '') h = {} @@ -1,6 +1,6 @@ #define RUBY_VERSION "2.5.6" #define RUBY_RELEASE_DATE "2019-08-27" -#define RUBY_PATCHLEVEL 185 +#define RUBY_PATCHLEVEL 186 #define RUBY_RELEASE_YEAR 2019 #define RUBY_RELEASE_MONTH 8 |