Skip to content
  • Daniel Colson's avatar
    32e406d6
    Ensure _id2ref finds symbols with the correct type · 32e406d6
    Daniel Colson authored
    
    
    Prior to this commit it was possible to call `ObjectSpace._id2ref` with
    an offset static symbol object_id and get back a new, incorrectly tagged
    symbol:
    
    ```
    > sensible_sym = ObjectSpace._id2ref(:a.object_id)
    => :a
    > nonsense_sym = ObjectSpace._id2ref(:a.object_id + 40)
    => :a
    > sensible_sym == nonsense_sym
    => false
    ```
    
    `nonsense_sym` ends up tagged with `RUBY_ID_INSTANCE` instead of
    `RB_ID_LOCAL`. That means we can do silly things like:
    
    ```
    > foo = Object.new
    > foo.instance_variable_set(:a, 123)
    (irb):2:in `instance_variable_set': `a' is not allowed as an instance variable name (NameError)
    > foo.instance_variable_set(ObjectSpace._id2ref(:a.object_id + 40), 123)
    => 123
    > foo.instance_variables
    => [:a]
    ```
    
    This was happening because `get_id_entry` ignores the tag bits when
    looking up the symbol. So `rb_id2str(symid)` would return a value and
    then we'd continue on with the nonsense `symid`.
    
    This commit prevents the situation by checking that the `symid` actually
    matches what we get back from `get_id_entry`. Now we get a `RangeError`
    for the nonsense id:
    
    ```
    > ObjectSpace._id2ref(:a.object_id)
    => :a
    > ObjectSpace._id2ref(:a.object_id + 40)
    (irb):1:in `_id2ref': 0x000000000013f408 is not symbol id value (RangeError)
    ```
    
    Co-authored-by: default avatarJohn Hawthorn <jhawthorn@github.com>
    32e406d6
    Ensure _id2ref finds symbols with the correct type
    Daniel Colson authored
    
    
    Prior to this commit it was possible to call `ObjectSpace._id2ref` with
    an offset static symbol object_id and get back a new, incorrectly tagged
    symbol:
    
    ```
    > sensible_sym = ObjectSpace._id2ref(:a.object_id)
    => :a
    > nonsense_sym = ObjectSpace._id2ref(:a.object_id + 40)
    => :a
    > sensible_sym == nonsense_sym
    => false
    ```
    
    `nonsense_sym` ends up tagged with `RUBY_ID_INSTANCE` instead of
    `RB_ID_LOCAL`. That means we can do silly things like:
    
    ```
    > foo = Object.new
    > foo.instance_variable_set(:a, 123)
    (irb):2:in `instance_variable_set': `a' is not allowed as an instance variable name (NameError)
    > foo.instance_variable_set(ObjectSpace._id2ref(:a.object_id + 40), 123)
    => 123
    > foo.instance_variables
    => [:a]
    ```
    
    This was happening because `get_id_entry` ignores the tag bits when
    looking up the symbol. So `rb_id2str(symid)` would return a value and
    then we'd continue on with the nonsense `symid`.
    
    This commit prevents the situation by checking that the `symid` actually
    matches what we get back from `get_id_entry`. Now we get a `RangeError`
    for the nonsense id:
    
    ```
    > ObjectSpace._id2ref(:a.object_id)
    => :a
    > ObjectSpace._id2ref(:a.object_id + 40)
    (irb):1:in `_id2ref': 0x000000000013f408 is not symbol id value (RangeError)
    ```
    
    Co-authored-by: default avatarJohn Hawthorn <jhawthorn@github.com>
Loading