Must the mrb_sys_fail() function raise an exception

Normal return of control from the `mrb_sys_fail()` function has unexpected results.
Example: double free, malloc with huge size used as error integer

The following is an example of an actual crash:

```console
% cat crash.rb
def SystemCallError._sys_fail(*a)
  nil
end

File.readlink("/404")

% bin/mruby crash.rb
zsh: segmentation fault (core dumped)  bin/mruby crash.rb
```
This commit is contained in:
dearblue
2022-04-10 21:36:59 +09:00
parent 676e9bcf81
commit ef5ae084d7
2 changed files with 4 additions and 5 deletions
+3 -4
View File
@@ -521,7 +521,7 @@ exception_call:
return mesg;
}
MRB_API void
MRB_API mrb_noreturn void
mrb_sys_fail(mrb_state *mrb, const char *mesg)
{
struct RClass *sce;
@@ -537,9 +537,8 @@ mrb_sys_fail(mrb_state *mrb, const char *mesg)
mrb_funcall_id(mrb, mrb_obj_value(sce), MRB_SYM(_sys_fail), 1, mrb_fixnum_value(no));
}
}
else {
mrb_raise(mrb, E_RUNTIME_ERROR, mesg);
}
mrb_raise(mrb, E_RUNTIME_ERROR, mesg);
}
MRB_API mrb_noreturn void