From 8a94d4b0d4f988d4e6dc2d3556e2504f44afab4b Mon Sep 17 00:00:00 2001 From: nagachika Date: Wed, 7 Aug 2019 12:23:48 +0000 Subject: merge revision(s) 9dec4e8fc3a6018261834b5ac9b9877f787b97ca: [Backport #15934] String#b: Don't depend on dependent string Registering a string that depend on a dependent string as fstring can lead to use-after-free. See c06ddfe and 3f95620 for details. The following script triggers use-after-free on trunk, 2.4.6, 2.5.5 and 2.6.3. Credits to @wanabe for using eval as a cross-version way of registering a fstring. ```ruby a = ('j' * 24).b.b eval('', binding, a) p a 4.times { GC.start } p a ``` - string.c (str_replace_shared_without_enc): when given a dependent string, depend on the root of the dependent string. [Bug #15934] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67733 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- string.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'string.c') diff --git a/string.c b/string.c index 847533ad6e..90ae17f54f 100644 --- a/string.c +++ b/string.c @@ -1163,19 +1163,26 @@ str_replace_shared_without_enc(VALUE str2, VALUE str) TERM_FILL(ptr2+len, termlen); } else { - str = rb_str_new_frozen(str); + VALUE root; + if (STR_SHARED_P(str)) { + root = RSTRING(str)->as.heap.aux.shared; + RSTRING_GETMEM(str, ptr, len); + } + else { + root = rb_str_new_frozen(str); + RSTRING_GETMEM(root, ptr, len); + } if (!STR_EMBED_P(str2) && !FL_TEST_RAW(str2, STR_SHARED|STR_NOFREE)) { /* TODO: check if str2 is a shared root */ char *ptr2 = STR_HEAP_PTR(str2); - if (STR_HEAP_PTR(str) != ptr2) { + if (ptr2 != ptr) { ruby_sized_xfree(ptr2, STR_HEAP_SIZE(str2)); } } FL_SET(str2, STR_NOEMBED); - RSTRING_GETMEM(str, ptr, len); RSTRING(str2)->as.heap.len = len; RSTRING(str2)->as.heap.ptr = ptr; - STR_SET_SHARED(str2, str); + STR_SET_SHARED(str2, root); } return str2; } -- cgit v1.2.3