admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed use-after-free by backtrace object

Browse Source 
The `MRB_TT_BACKTRACE` object has been added for the purpose.

Previously, "use-after-free" could occur because the reference count in `backtrace_location::irep` was not incremented.

fixed #6160
This commit is contained in:
dearblue
2024-01-31 22:17:16 +09:00
parent 363f795432
commit 9543cfa7ee
5 changed files with 64 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/mruby/internal.h
+12
View File
@@ -61,6 +61,18 @@ mrb_value mrb_exc_mesg_get(mrb_state *mrb, struct RException *exc);
mrb_value mrb_f_raise(mrb_state*, mrb_value);
mrb_value mrb_make_exception(mrb_state *mrb, mrb_value exc, mrb_value mesg);
struct RBacktrace {
MRB_OBJECT_HEADER;
size_t len;
struct mrb_backtrace_location *locations;
};
struct mrb_backtrace_location {
mrb_sym method_id;
int32_t idx;
const struct RProc *proc;
};
/* gc */
void mrb_gc_mark_mt(mrb_state*, struct RClass*);
size_t mrb_gc_mark_mt_size(mrb_state*, struct RClass*);
include/mruby/value.h
+2 -1
View File
@@ -159,7 +159,8 @@ static const unsigned int IEEE754_INFINITY_BITS_SINGLE = 0x7F800000;
f(MRB_TT_BREAK, struct RBreak, "break") \
f(MRB_TT_COMPLEX, struct RComplex, "Complex") \
f(MRB_TT_RATIONAL, struct RRational, "Rational") \
f(MRB_TT_BIGINT, struct RBigint, "Integer")
f(MRB_TT_BIGINT, struct RBigint, "Integer") \
f(MRB_TT_BACKTRACE, struct RBacktrace, "backtrace")
enum mrb_vtype {
#define MRB_VTYPE_DEFINE(tt, type, name) tt,