merge revision(s) 92dd9734a967c20e628c8f77c5ce700058dcd58c: [Backport #20950]

	Fix use-after-free in ep in Proc#dup for ifunc procs

	[Bug #20950]

	ifunc proc has the ep allocated in the cfunc_proc_t which is the data of
	the TypedData object. If an ifunc proc is duplicated, the ep points to
	the ep of the source object. If the source object is freed, then the ep
	of the duplicated object now points to a freed memory region. If we try
	to use the ep we could crash.

	For example, the following script crashes:

	    p = { a: 1 }.to_proc
	    100.times do
	      p = p.dup
	      GC.start
	      p.call
	    rescue ArgumentError
	    end

	This commit changes ifunc proc to also duplicate the ep when it is duplicated.

1 files changed, 12 insertions, 0 deletions

diff --git a/test/ruby/test_proc.rb b/test/ruby/test_proc.rb
index 19fc89357a..511826c636 100644
--- a/test/ruby/test_proc.rb
+++ b/test/ruby/test_proc.rb
@@ -410,6 +410,18 @@ class TestProc < Test::Unit::TestCase
     assert_throw(:initialize_dup) {c1.new{}.dup}
   end
 
+  def test_dup_ifunc_proc_bug_20950
+    assert_normal_exit(<<~RUBY, "[Bug #20950]")
+      p = { a: 1 }.to_proc
+      100.times do
+        p = p.dup
+        GC.start
+        p.call
+      rescue ArgumentError
+      end
+    RUBY
+  end
+
   def test_clone_subclass
     c1 = Class.new(Proc)
     assert_equal c1, c1.new{}.clone.class, '[Bug #17545]'