Skip to content

Wrap mrb_raise() and mrb_raisef() with macros #6359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dearblue wants to merge 1 commit into from
Closed

Wrap mrb_raise() and mrb_raisef() with macros #6359

dearblue wants to merge 1 commit into from

Conversation

@dearblue
Copy link
Contributor

@dearblue dearblue commented Sep 20, 2024

This change is mainly to avoid use-after-free, which tends to occur when C strings are passed as arguments.

Here is a scenario in which use-after-free is valid:

  • Remove the RuntimeError class constant.
  • Define the Object.const_missing method.
  • The address to the C string is taken from the string object by mrb_get_args() and so on.
  • To resolve E_RUNTIME_ERROR, Object.const_missing is called via mrb_exc_get_id().
  • Make a major change to the string object to invalidate the address of the C string.
  • The mrb_str_new_cstr() called by mrb_raise() references the invalidated C string.

This patch is reimplemented with macros to ensure that the string object is created and then mrb_exc_get_id() is called.

For compatibility when linked as shared object files or language bindings, the original function symbols are still available.

INCOMPATIBILITY NOTE:
These macro functions are now statements rather than expressions. So they can no longer be used inside the ternary and comma operators.

@dearblue
Wrap mrb_raise() and mrb_raisef() with macros
69d7546 
This change is mainly to avoid use-after-free, which tends to occur when C strings are passed as arguments.

Here is a scenario in which use-after-free is valid:

  - Remove the `RuntimeError` class constant.
  - Define the `Object.const_missing` method.
  - The address to the C string is taken from the string object by `mrb_get_args()` and so on.
  - To resolve `E_RUNTIME_ERROR`, `Object.const_missing` is called via `mrb_exc_get_id()`.
  - Make a major change to the string object to invalidate the address of the C string.
  - The `mrb_str_new_cstr()` called by `mrb_raise()` references the invalidated C string.

This patch is reimplemented with macros to ensure that the string object is created and then `mrb_exc_get_id()` is called.

For compatibility when linked as shared object files or language bindings, the original function symbols are still available.

**INCOMPATIBILITY NOTE**:
These macro functions are now statements rather than expressions.
So they can no longer be used inside the ternary and comma operators.
@dearblue dearblue requested a review from matz as a code owner September 20, 2024 13:27
@dearblue
Copy link
Contributor Author

dearblue commented Sep 20, 2024

Use-after-free with the File.open method provided by mruby-io.

class Object
  ArgumentError_origin = ArgumentError
  remove_const :ArgumentError

  def Object.const_missing(name)
    return unless name == :ArgumentError
    $mode.clear
    ArgumentError_origin
  end
end

File.open("/403", $mode = "a" * 30)
% valgrind -- build/host/bin/mruby uaf-raisef.rb
==31668== Memcheck, a memory error detector
==31668== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==31668== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info
==31668== Command: build/host/bin/mruby uaf-raisef.rb
==31668==
==31668== Invalid read of size 1
==31668==    at 0x4854150: strlen (vg_replace_strmem.c:519)
==31668==    by 0x26DD9D: mrb_vformat (error.c:324)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a90 is 0 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
==31668== Invalid read of size 1
==31668==    at 0x4854159: strlen (vg_replace_strmem.c:519)
==31668==    by 0x26DD9D: mrb_vformat (error.c:324)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a92 is 2 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
==31668== Invalid read of size 2
==31668==    at 0x4855710: memcpy (vg_replace_strmem.c:1167)
==31668==    by 0x28662D: mrb_str_cat (string.c:2862)
==31668==    by 0x26DAC7: mrb_vformat (error.c:311)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a90 is 0 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
==31668== Invalid read of size 2
==31668==    at 0x4855721: memcpy (vg_replace_strmem.c:1167)
==31668==    by 0x28662D: mrb_str_cat (string.c:2862)
==31668==    by 0x26DAC7: mrb_vformat (error.c:311)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a94 is 4 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
==31668== Invalid read of size 2
==31668==    at 0x4855740: memcpy (vg_replace_strmem.c:1167)
==31668==    by 0x28662D: mrb_str_cat (string.c:2862)
==31668==    by 0x26DAC7: mrb_vformat (error.c:311)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a96 is 6 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
==31668== Invalid read of size 2
==31668==    at 0x4855746: memcpy (vg_replace_strmem.c:1167)
==31668==    by 0x28662D: mrb_str_cat (string.c:2862)
==31668==    by 0x26DAC7: mrb_vformat (error.c:311)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a98 is 8 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
==31668== Invalid read of size 2
==31668==    at 0x485574E: memcpy (vg_replace_strmem.c:1167)
==31668==    by 0x28662D: mrb_str_cat (string.c:2862)
==31668==    by 0x26DAC7: mrb_vformat (error.c:311)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a9a is 10 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
==31668== Invalid read of size 2
==31668==    at 0x4855756: memcpy (vg_replace_strmem.c:1167)
==31668==    by 0x28662D: mrb_str_cat (string.c:2862)
==31668==    by 0x26DAC7: mrb_vformat (error.c:311)
==31668==    by 0x26E14A: error_va (error.c:397)
==31668==    by 0x26E117: mrb_raisef (error.c:407)
==31668==    by 0x2EAB52: io_mode_to_flags (io.c:0)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==  Address 0x54e1a9c is 12 bytes inside a block of size 31 free'd
==31668==    at 0x484F2EC: free (vg_replace_malloc.c:993)
==31668==    by 0x283E48: mrb_default_allocf (allocf.c:22)
==31668==    by 0x2851DF: str_replace (string.c:0)
==31668==    by 0x288B6F: mrb_str_replace (string.c:1970)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x28F5B6: mrb_run (vm.c:3058)
==31668==    by 0x28F5B6: mrb_funcall_with_block (vm.c:750)
==31668==    by 0x28D643: const_get (variable.c:793)
==31668==    by 0x2674E3: mrb_exc_get_id (class.c:662)
==31668==    by 0x2EAB3D: io_modestr_to_flags (io.c:166)
==31668==    by 0x2EAB3D: io_mode_to_flags (io.c:177)
==31668==    by 0x2E894D: io_s_sysopen (io.c:932)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==  Block was alloc'd at
==31668==    at 0x4852321: realloc (vg_replace_malloc.c:1806)
==31668==    by 0x270448: mrb_realloc_simple (gc.c:197)
==31668==    by 0x270448: mrb_realloc (gc.c:211)
==31668==    by 0x270448: mrb_malloc (gc.c:227)
==31668==    by 0x286F78: str_init_normal_capa (string.c:58)
==31668==    by 0x286F78: str_init_normal (string.c:71)
==31668==    by 0x286F78: str_new (string.c:152)
==31668==    by 0x286F78: mrb_str_times (string.c:1035)
==31668==    by 0x29535F: mrb_vm_exec (vm.c:0)
==31668==    by 0x2BA293: mrb_load_exec (parse.y:6912)
==31668==    by 0x2BA5B3: mrb_load_detect_file_cxt (parse.y:6955)
==31668==    by 0x260A43: main (mruby.c:353)
==31668==
trace (most recent call last):
        [1] uaf-raisef.rb:14
uaf-raisef.rb:14:in sysopen: illegal access mode aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa (ArgumentError)
==31668==
==31668== HEAP SUMMARY:
==31668==     in use at exit: 0 bytes in 0 blocks
==31668==   total heap usage: 793 allocs, 793 frees, 231,095 bytes allocated
==31668==
==31668== All heap blocks were freed -- no leaks are possible
==31668==
==31668== For lists of detected and suppressed errors, rerun with: -s
==31668== ERROR SUMMARY: 46 errors from 8 contexts (suppressed: 0 from 0)

@dearblue dearblue mentioned this pull request Sep 20, 2024
Open
@matz matz closed this in fa68e63 Oct 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matz matz Awaiting requested review from matz matz is a code owner

Assignees

No one assigned

Labels

core mrbgems

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dearblue