admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Separate jump destination check in OP_R_RETURN.

Browse Source 
In the past code, the current `callinfo (ci)` was modified, thus it was
possible to pop `ci` beyond the `cibase`, that could cause out of memory
bound access for the code like the following:

```ruby
def m2
  lambda {
    Proc.new {
      return :return # return from the method
    }
  }.call.call
  :never_reached
end

p m2
```
This commit is contained in:
Yukihiro "Matz" Matsumoto
2020-09-01 18:06:49 +09:00
parent b01207ea94
commit 4cf1da9542
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/vm.c
+11 -6
View File
@@ -2029,11 +2029,20 @@ RETRY_TRY_BLOCK:
goto L_RAISE;
}
}
/* check jump destination */
while (cibase <= ci && ci->proc != dst) {
if (ci->acc < 0) {
if (ci->acc < 0) { /* jump cross C boudary */
localjump_error(mrb, LOCALJUMP_ERROR_RETURN);
goto L_RAISE;
}
ci--;
}
if (ci <= cibase) { /* no jump destination */
localjump_error(mrb, LOCALJUMP_ERROR_RETURN);
goto L_RAISE;
}
ci = mrb->c->ci;
while (cibase <= ci && ci->proc != dst) {
CHECKPOINT_RESTORE(RBREAK_TAG_RETURN_BLOCK) {
cibase = mrb->c->cibase;
dst = top_proc(mrb, proc);
@@ -2045,12 +2054,8 @@ RETRY_TRY_BLOCK:
pc = ci->pc;
ci = cipop(mrb);
}
mrb->exc = NULL; /* clear break object */
proc = ci->proc;
if (ci <= cibase) {
localjump_error(mrb, LOCALJUMP_ERROR_RETURN);
goto L_RAISE;
}
mrb->exc = NULL; /* clear break object */
break;
}
/* fallthrough */