The `mrb_str_pool()` function has a path to call `malloc()` twice.
If occurs `NoMemoryError` exception in second `malloc()`,
first `malloc()` pointer is not freed.
As a result of this change, no backtrace information is set
for NoMemoryError (`mrb->nomem_err`).
Detailes:
When generating a backtrace, called `mrb_intern_lit()`,
`mrb_str_new_cstr()` and `mrb_obj_iv_set()` function with
`exc_debug_info()` function in `src/error.c`.
If a `NoMemoryError` exception occurs at this time,
the `exc_debug_info()` function will be called again,
and in the same way `NoMemoryError` exception raised will result
in an infinite loop to occurs stack overflow (and SIGSEGV).
[Breaking changes]
Developers must use following APIs for accessing attributes of RRange
because RRange structure depends on boxing setting.
- mrb_range_beg
- mrb_range_end
- mrb_range_excl_p
We have removed implicit conversion to strings using `to_int`. But some
users still using `to_int` as a typical integer method, i.e. they do
string check by code like: `obj.respond_to?(:to_int)`. So we have
recovered the method.
We have removed implicit conversion to strings using `to_str`. But some
people still using `to_str` as a typical string method, i.e. they do
string check by code like: `obj.respond_to?(:to_str)`. So we have
recovered the method.
* return `void` instead of `mrb_bool'.
* non zero return value from `func` breaks the loop.
* no longer remove items on negative return value from `func`.
We have added internal convenience method `__to_str` which
does string type check.
The issue #3854 was fixed but fundamental flaw of lack of stack
depth check along with fibers still remains. Use `MRB_GC_FIXED_ARENA`
for workaround.
The ISO standard does not include implicit type conversion using
`to_int`. This implicit conversion often causes vulnerability.
There will be no more attacks like #4120.
In addition, we have added internal convenience method `__to_int` which
does type check and conversion (from floats).
The GC may occur between `sg_shift` and `mrb_assoc_new`, in which
case `key` and `value` could be freed even tough they are still alive.
The issue is found and fixed by https://hackerone.com/hexodus
The saving `pc` position should be beginning of the instruction.
But after `mruby 2.0` byte code modification, the `pc` variable
points the beginning of the next instruction. We save the previous
position in a local variable `pc0`.
dearblue