Skip to content
  • Takashi Kokubun's avatar
    b44c02ad
    merge revision(s) c479492a: [Backport #20427] · b44c02ad
    Takashi Kokubun authored
    	Resize ary when `Array#sort!` block modifies embedded ary
    
    	In cases where `rb_ary_sort_bang` is called with a block and
    	tmp is an embedded array, we need to account for the block
    	potentially impacting the capacity of ary.
    
    	ex:
    	```
    	var_0 = (1..70).to_a
    	var_0.sort! do |var_0_block_129, var_1_block_129|
    	  var_0.pop
    	  var_1_block_129 <=> var_0_block_129
    	end.shift(3)
    	```
    
    	The above example can put the array into a corrupted state
    	resulting in a heap buffer overflow and possible segfault:
    	```
    	ERROR: AddressSanitizer: heap-buffer-overflow on address [...]
    	WRITE of size 560 at 0x60b0000034f0 thread T0 [...]
    	```
    
    	This commit adds a conditional to determine when the capacity
    	of ary has been modified by the provided block. If this is
    	the case, ensure that the capacity of ary is adjusted to
    	handle at minimum the len of tmp.
    b44c02ad
    merge revision(s) c479492a: [Backport #20427]
    Takashi Kokubun authored
    	Resize ary when `Array#sort!` block modifies embedded ary
    
    	In cases where `rb_ary_sort_bang` is called with a block and
    	tmp is an embedded array, we need to account for the block
    	potentially impacting the capacity of ary.
    
    	ex:
    	```
    	var_0 = (1..70).to_a
    	var_0.sort! do |var_0_block_129, var_1_block_129|
    	  var_0.pop
    	  var_1_block_129 <=> var_0_block_129
    	end.shift(3)
    	```
    
    	The above example can put the array into a corrupted state
    	resulting in a heap buffer overflow and possible segfault:
    	```
    	ERROR: AddressSanitizer: heap-buffer-overflow on address [...]
    	WRITE of size 560 at 0x60b0000034f0 thread T0 [...]
    	```
    
    	This commit adds a conditional to determine when the capacity
    	of ary has been modified by the provided block. If this is
    	the case, ensure that the capacity of ary is adjusted to
    	handle at minimum the len of tmp.
Loading