admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix invalid pointer free inside other heap's block

Browse Source 
1. `e = mrb_obj_alloc(...)`
 2. `e->stack = mrb->c->stack` (`mrb->c->stack` is anywhere in the range `stbase...stend`)
 3. And raised exception by `mrb_malloc()`!
 4. `mrb_free(e->stack)` by GC part (wrong free)
This commit is contained in:
dearblue
2019-01-19 22:22:44 +09:00
parent 52e3d5d858
commit b178914b11
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/proc.c
+7
View File
@@ -120,7 +120,14 @@ mrb_proc_new_cfunc_with_env(mrb_state *mrb, mrb_func_t func, mrb_int argc, const
p->flags |= MRB_PROC_ENVSET;
mrb_field_write_barrier(mrb, (struct RBasic*)p, (struct RBasic*)e);
MRB_ENV_UNSHARE_STACK(e);
/* NOTE: Prevents keeping invalid addresses when NoMemoryError is raised from `mrb_malloc()`. */
e->stack = NULL;
MRB_ENV_SET_STACK_LEN(e, 0);
e->stack = (mrb_value*)mrb_malloc(mrb, sizeof(mrb_value) * argc);
MRB_ENV_SET_STACK_LEN(e, argc);
if (argv) {
for (i = 0; i < argc; ++i) {
e->stack[i] = argv[i];