diff options
author | NARUSE, Yui <naruse@airemix.jp> | 2023-03-17 13:40:04 +0900 |
---|---|---|
committer | NARUSE, Yui <naruse@airemix.jp> | 2023-03-17 13:40:04 +0900 |
commit | f3abe5ba645839fb2a686aee18d3466b59256af0 (patch) | |
tree | f5b5da96aa8e41115915eea4309707dcd100f88b /version.h | |
parent | b309c246ee70926d593d3857e1625202e2d0f67b (diff) |
merge revision(s) 0700d0fd1c77b4fddf803dea3c10be654df600ff,62c2082f1f726cb90d8c332fbedbecf41d5d82ec: [Backport #19469]
Fix indentation in vm_setivar_default
---
vm_insnhelper.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
[Bug #19469] Fix crash when resizing generic iv list
The following script can sometimes trigger a crash:
```ruby
GC.stress = true
class Array
def foo(bool)
if bool
@a = 1
@b = 2
@c = 1
else
@c = 1
end
end
end
obj = []
obj.foo(true)
obj2 = []
obj2.foo(false)
obj3 = []
obj3.foo(true)
```
This is because vm_setivar_default calls rb_ensure_generic_iv_list_size
to resize the iv list. However, the call to gen_ivtbl_resize reallocs
the iv list, and then inserts into the generic iv table. If the
st_insert triggers a GC then the old iv list will be read during
marking, causing a use-after-free bug.
Co-Authored-By: Jemma Issroff <jemmaissroff@gmail.com>
---
internal/variable.h | 2 +-
variable.c | 23 ++++++++++++++++++-----
vm_insnhelper.c | 4 ++--
3 files changed, 21 insertions(+), 8 deletions(-)
Diffstat (limited to 'version.h')
-rw-r--r-- | version.h | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -11,7 +11,7 @@ # define RUBY_VERSION_MINOR RUBY_API_VERSION_MINOR #define RUBY_VERSION_TEENY 1 #define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR -#define RUBY_PATCHLEVEL 41 +#define RUBY_PATCHLEVEL 42 #include "ruby/version.h" #include "ruby/internal/abi.h" |