Skip to content
  • Peter Zhu's avatar
    92dd9734
    Fix use-after-free in ep in Proc#dup for ifunc procs · 92dd9734
    Peter Zhu authored
    [Bug #20950]
    
    ifunc proc has the ep allocated in the cfunc_proc_t which is the data of
    the TypedData object. If an ifunc proc is duplicated, the ep points to
    the ep of the source object. If the source object is freed, then the ep
    of the duplicated object now points to a freed memory region. If we try
    to use the ep we could crash.
    
    For example, the following script crashes:
    
        p = { a: 1 }.to_proc
        100.times do
          p = p.dup
          GC.start
          p.call
        rescue ArgumentError
        end
    
    This commit changes ifunc proc to also duplicate the ep when it is duplicated.
    92dd9734
    Fix use-after-free in ep in Proc#dup for ifunc procs
    Peter Zhu authored
    [Bug #20950]
    
    ifunc proc has the ep allocated in the cfunc_proc_t which is the data of
    the TypedData object. If an ifunc proc is duplicated, the ep points to
    the ep of the source object. If the source object is freed, then the ep
    of the duplicated object now points to a freed memory region. If we try
    to use the ep we could crash.
    
    For example, the following script crashes:
    
        p = { a: 1 }.to_proc
        100.times do
          p = p.dup
          GC.start
          p.call
        rescue ArgumentError
        end
    
    This commit changes ifunc proc to also duplicate the ep when it is duplicated.
Loading