summaryrefslogtreecommitdiff
path: root/test/-ext-
diff options
context:
space:
mode:
authorAlan Wu <XrXr@users.noreply.github.com>2019-09-22 15:36:00 -0400
committerNobuyoshi Nakada <nobu@ruby-lang.org>2019-09-26 15:30:18 +0900
commit93faa011d393bb4b5cf31a0cbb46922f0a5e7cdc (patch)
tree1e1d8f113c2abcca77aa1ede7e2c36bb252e4f7b /test/-ext-
parent3cee99808d629c0ec493955ce8ea019d1f8a637b (diff)
Tag string shared roots to fix use-after-free
The buffer deduplication codepath in rb_fstring can be used to free the buffer of shared string roots, which leads to use-after-free. Introudce a new flag to tag strings that at one point have been a shared root. Check for it in rb_fstring to avoid freeing buffers that are shared by multiple strings. This change is based on nobu's idea in [ruby-core:94838]. The included test case test for the sequence of calls to internal functions that lead to this bug. See attached ticket for Ruby level repros. [Bug #16151]
Notes
Notes: Merged: https://github.com/ruby/ruby/pull/2480
Diffstat (limited to 'test/-ext-')
-rw-r--r--test/-ext-/string/test_fstring.rb9
1 files changed, 9 insertions, 0 deletions
diff --git a/test/-ext-/string/test_fstring.rb b/test/-ext-/string/test_fstring.rb
index 8612b5d..9a54f6b 100644
--- a/test/-ext-/string/test_fstring.rb
+++ b/test/-ext-/string/test_fstring.rb
@@ -71,4 +71,13 @@ class Test_String_Fstring < Test::Unit::TestCase
str.freeze
assert_fstring(str) {|s| assert_instance_of(S, s)}
end
+
+ def test_shared_string_safety
+ -('a' * 30).force_encoding(Encoding::ASCII)
+ str = ('a' * 30).force_encoding(Encoding::ASCII).taint
+ frozen_str = Bug::String.rb_str_new_frozen(str)
+ assert_fstring(frozen_str) {|s| assert_equal(str, s)}
+ GC.start
+ assert_equal('a' * 30, str, "[Bug #16151]")
+ end
end