added a new "Security Issues" section that summarizes the security reporting
process: email for RCE vulnerabilities, issue tracker for VM crashes. links
to SECURITY.md for complete details on what qualifies as a security issue.
Co-authored-by: Claude <noreply@anthropic.com>
restructured the security policy to reduce misunderstandings:
- high priority: remote code execution (RCE) vulnerabilities only
- lower priority: VM crashes from valid Ruby code (accepted but preferably
reported as bugs on issue tracker)
- out of scope: resource exhaustion, malformed bytecode, C API misuse,
theoretical undefined behavior, allocation warnings
added detailed rationale and examples for each category, explaining mruby's
role as an embeddable interpreter and the host application's responsibility
for sandboxing and resource management.
Co-authored-by: Claude <noreply@anthropic.com>
the keyword argument handling code was checking if kdict is not nil
before calling mrb_hash_size(), but didn't verify it's actually a hash.
malformed bytecode could cause a non-hash value to be stored in the
keyword dictionary register, leading to a NULL pointer dereference in
h_size(). add mrb_hash_p() check to prevent the crash.
Co-authored-by: Claude <noreply@anthropic.com>
since all current uses check for failure (!MRB_OPEN_SUCCESS), add
MRB_OPEN_FAILURE() as the primary macro for better readability. define
MRB_OPEN_SUCCESS() in terms of MRB_OPEN_FAILURE() to avoid duplication
and optimize the common case. update all usage sites to use the clearer
MRB_OPEN_FAILURE() form.
Co-authored-by: Claude <noreply@anthropic.com>
mpz_mod() was calling mpz_init_heap() on its output parameter, assuming it
was uninitialized. However, callers like mpz_powm_i() pass already-
initialized variables, causing the old allocations to leak. Changed to use
mpz_realloc() which properly handles both cases.
Co-authored-by: Claude <noreply@anthropic.com>
prevents buffer overrun in karatsuba multiplication scratch space due to
rounding errors in recursive partitioning. empirically determined 8-limb
margin fixes valgrind-detected overrun with large exponentiations.
Co-authored-by: Claude <noreply@anthropic.com>
made mrb_print_error() handle NULL by printing "Failed to allocate
mrb_state" when mrb is NULL. since mrb_close() already handles NULL,
this allows simplified error checking pattern:
if (!MRB_OPEN_SUCCESS(mrb)) {
mrb_print_error(mrb); // handles NULL
mrb_close(mrb); // handles NULL
return EXIT_FAILURE;
}
updated all binary tools (mruby, mirb, mrdb, mrbtest) to use this
simplified pattern, removing nested if checks.
Co-authored-by: Claude <noreply@anthropic.com>
changed mrb_open() and mrb_open_core() to return mrb_state with mrb->exc
set (instead of NULL) when initialization fails. this allows callers to
programmatically inspect error details, which is essential for embedded
systems without stderr. return NULL only for true allocation failure.
added MRB_OPEN_SUCCESS(mrb) macro to check initialization success, since
mrb != NULL no longer guarantees success. updated all binary tools
(mruby, mirb, mrdb, mrbtest) to use new pattern: check MRB_OPEN_SUCCESS,
print exception details via mrb_print_error if available, then mrb_close.
mrb_core_init_protect now preserves exception in mrb->exc instead of
printing and clearing it, giving caller control over error handling.
breaking change: callers must use MRB_OPEN_SUCCESS(mrb) or check both
mrb != NULL && mrb->exc == NULL. old NULL-only checks will miss
initialization failures.
Co-authored-by: Claude <noreply@anthropic.com>
dd96afd added const_added hook call to mrb_const_set(), but calling
mrb_funcall_argv() during core initialization (before bootstrapping
completes) fails on bare metal platforms where VM is not fully ready.
skip hook during mrb->bootstrapping phase, matching pattern used in
class.c for method cache clearing.
Co-authored-by: Claude <noreply@anthropic.com>
set_do_flatten allocated temporary kset_t* via kset_init(). when
exceptions were raised during flattening (e.g., from hash function),
temporary kset was never freed. refactored to pass result set directly
and fill in-place. result set object is GC-protected, so exceptions
are handled cleanly without leaks.
Co-authored-by: Claude <noreply@anthropic.com>
kh_is_end() safely checks if an iterator is at the end position,
preventing issues when the hash table is modified during iteration.
replaced direct kset_end() comparisons with kset_is_end() calls
throughout set operations.
Co-authored-by: Claude <noreply@anthropic.com>
during eql? callbacks, array modifications can cause elements in khash to
be freed by GC, leading to use-after-free. create temporary shared copies
of arrays before populating khash to protect elements during callbacks.
Co-authored-by: Claude <noreply@anthropic.com>
add exception handling with MRB_TRY/MRB_CATCH to ensure khash cleanup
when eql? or hash methods raise exceptions. use kh_is_end macro for safe
khash iteration.
affected functions: Array#intersect?, Array#-, Array#|, Array#&, Array#uniq!
Co-authored-by: Claude <noreply@anthropic.com>
when overriding struct#==, array#==, or hash#== with super, the recursion
detection incorrectly treated the super call as a circular reference. this
was caused by commit 5ca2d442 which added recursion detection.
the fix introduces mrb_recursive_func_p that starts from ci[-2] instead of
ci[-1], skipping the immediate parent frame which may be a ruby override
calling super. equality methods (==, eql?) now use this function, while
inspect methods keep using mrb_recursive_method_p for immediate circular
reference detection.
Co-authored-by: Claude <noreply@anthropic.com>
Add arg_error() helper function to replace goto statements used for
error handling. This function is marked with mrb_noreturn attribute
since it calls mrb_raise which never returns.
Co-authored-by: Claude <noreply@anthropic.com>
Add mode_error() and badfd_error() helper functions to replace
goto statements used for error handling. These functions are marked
with mrb_noreturn attribute since they call mrb_raise/mrb_sys_fail
which never return.
Co-authored-by: Claude <noreply@anthropic.com>
Add invalid_address_error() helper function to replace goto statements
used for error handling. This function is marked with mrb_noreturn
attribute since it calls mrb_raise() which never returns.
Co-authored-by: Claude <noreply@anthropic.com>
Add badname_error() and caller_error() helper functions to replace
goto statements used for error handling. These functions are marked
with mrb_noreturn attribute since they call mrb_raise() which never
returns.
Co-authored-by: Claude <noreply@anthropic.com>
allocate ** keyword dictionary register when methods have keyword
arguments (parse.y new_args_tail), broken in commit 26ea71260 during
cons-list to struct migration. reconstruct keyword hash after KEYEND
from extracted keyword local variables so super can access keyword
values. encode block parameter flag in ainfo bit 13 and generate
LOADNIL for block register in codegen_zsuper when parent has keywords
but no block parameter.
Co-authored-by: Claude <noreply@anthropic.com>
The `mrb_obj_as_string()` function can call the `#to_s` method.
String addresses and string lengths obtained outside the `KSET_FOREACH()` loop may become invalid.
The primary reason is to fix an issue that occurs when an element is removed from the khash data during the `KHASH_FOREACH()` loop.
If the value of `kh_end()` becomes smaller than `k` during the loop, it will repeat a meaningless internal loop until an integer overflow occurs.
Yukihiro "Matz" Matsumoto