summaryrefslogtreecommitdiff
path: root/version.h
diff options
context:
space:
mode:
authorNARUSE, Yui <naruse@airemix.jp>2023-03-17 13:40:04 +0900
committerNARUSE, Yui <naruse@airemix.jp>2023-03-17 13:40:04 +0900
commitf3abe5ba645839fb2a686aee18d3466b59256af0 (patch)
treef5b5da96aa8e41115915eea4309707dcd100f88b /version.h
parentb309c246ee70926d593d3857e1625202e2d0f67b (diff)
merge revision(s) 0700d0fd1c77b4fddf803dea3c10be654df600ff,62c2082f1f726cb90d8c332fbedbecf41d5d82ec: [Backport #19469]
Fix indentation in vm_setivar_default --- vm_insnhelper.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) [Bug #19469] Fix crash when resizing generic iv list The following script can sometimes trigger a crash: ```ruby GC.stress = true class Array def foo(bool) if bool @a = 1 @b = 2 @c = 1 else @c = 1 end end end obj = [] obj.foo(true) obj2 = [] obj2.foo(false) obj3 = [] obj3.foo(true) ``` This is because vm_setivar_default calls rb_ensure_generic_iv_list_size to resize the iv list. However, the call to gen_ivtbl_resize reallocs the iv list, and then inserts into the generic iv table. If the st_insert triggers a GC then the old iv list will be read during marking, causing a use-after-free bug. Co-Authored-By: Jemma Issroff <jemmaissroff@gmail.com> --- internal/variable.h | 2 +- variable.c | 23 ++++++++++++++++++----- vm_insnhelper.c | 4 ++-- 3 files changed, 21 insertions(+), 8 deletions(-)
Diffstat (limited to 'version.h')
-rw-r--r--version.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/version.h b/version.h
index 5dac221817..a148cc6c3a 100644
--- a/version.h
+++ b/version.h
@@ -11,7 +11,7 @@
# define RUBY_VERSION_MINOR RUBY_API_VERSION_MINOR
#define RUBY_VERSION_TEENY 1
#define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR
-#define RUBY_PATCHLEVEL 41
+#define RUBY_PATCHLEVEL 42
#include "ruby/version.h"
#include "ruby/internal/abi.h"