mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
f1523d2404
commit 2d7d545c4c4bfce7fdcbcbe9baaeb437915742f0 Merge: 625a1249b178914bAuthor: Yukihiro "Matz" Matsumoto <matz@ruby.or.jp> Date: Fri Jun 5 14:35:13 2020 +0900 Merge branch 'fix-mrb_open-with-nomem' of https://github.com/dearblue/mruby into dearblue-fix-mrb_open-with-nomem commitb178914b11Author: dearblue <dearblue@users.noreply.github.com> Date: Sat Jan 19 22:22:44 2019 +0900 Fix invalid pointer free inside other heap's block 1. `e = mrb_obj_alloc(...)` 2. `e->stack = mrb->c->stack` (`mrb->c->stack` is anywhere in the range `stbase...stend`) 3. And raised exception by `mrb_malloc()`! 4. `mrb_free(e->stack)` by GC part (wrong free) commit52e3d5d858Author: dearblue <dearblue@users.noreply.github.com> Date: Sat Jan 19 21:55:36 2019 +0900 Fix memory leak for temporary symbols when out of memory commit4c5499b88eAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 11:42:07 2019 +0900 Fix uninitialized pointer dereference for debug section commit8e993167deAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 11:41:09 2019 +0900 Fix memory leak for temporary filenames when out of memory commit8b422577e6Author: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 10:57:51 2019 +0900 Fix memory leak for irep when out of memory commit6b35ebf49aAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 10:55:50 2019 +0900 Fix uninitialized pointer dereference when do not finished initializing irep commit2531f2631eAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 10:48:15 2019 +0900 Fix NULL pointer dereference when do not finished initializing irep commite2d6896ebaAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sat Jan 19 12:54:19 2019 +0900 Fix memory leak for irep when out of memory by `mrb_proc_new()` commitb6214ff8a0Author: dearblue <dearblue@users.noreply.github.com> Date: Sat Jan 19 12:53:07 2019 +0900 Fix memory leak for `khash_t` in `kh_init_size()` when out of memory by `kh_alloc()` commit19162dd6c1Author: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 02:15:07 2019 +0900 Fix memory leak for symbol string when out of memory in `kh_put()` commit15e67297ffAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 02:12:24 2019 +0900 Fix keep wrong symbol index when out of memory commit3f8e2b3752Author: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 02:08:13 2019 +0900 Fix keep wrong symbol capacity when out of memory commita3cfe755abAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sat Jan 19 10:11:37 2019 +0900 Fix NULL pointer dereference `mrb->c` by `mark_context()` commitd9c7b6be6eAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 15:25:09 2019 +0900 Fix protect exception for print error message commit100642750eAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 11:59:02 2019 +0900 Protect exception for mruby core initialization commit7a0418304eAuthor: dearblue <dearblue@users.noreply.github.com> Date: Fri Jan 18 20:38:27 2019 +0900 Fix memory leak for string object when out of memory The `mrb_str_pool()` function has a path to call `malloc()` twice. If occurs `NoMemoryError` exception in second `malloc()`, first `malloc()` pointer is not freed. commitfef1c152ceAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sat Jan 19 13:05:09 2019 +0900 Fix stack overflow when out of memory As a result of this change, no backtrace information is set for NoMemoryError (`mrb->nomem_err`). Detailes: When generating a backtrace, called `mrb_intern_lit()`, `mrb_str_new_cstr()` and `mrb_obj_iv_set()` function with `exc_debug_info()` function in `src/error.c`. If a `NoMemoryError` exception occurs at this time, the `exc_debug_info()` function will be called again, and in the same way `NoMemoryError` exception raised will result in an infinite loop to occurs stack overflow (and SIGSEGV). commitda7d7f881bAuthor: dearblue <dearblue@users.noreply.github.com> Date: Sun Jan 20 12:00:38 2019 +0900 Fix NULL pointer dereference `mrb->nomem_err` when not initialized Add internal functions (not `static`): * `mrb_raise_nomemory()` * `mrb_core_init_abort()`
242 lines
4.9 KiB
C
242 lines
4.9 KiB
C
/*
|
|
** state.c - mrb_state open/close functions
|
|
**
|
|
** See Copyright Notice in mruby.h
|
|
*/
|
|
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <mruby.h>
|
|
#include <mruby/irep.h>
|
|
#include <mruby/variable.h>
|
|
#include <mruby/debug.h>
|
|
#include <mruby/string.h>
|
|
#include <mruby/class.h>
|
|
|
|
void mrb_init_core(mrb_state*);
|
|
void mrb_init_mrbgems(mrb_state*);
|
|
|
|
void mrb_gc_init(mrb_state*, mrb_gc *gc);
|
|
void mrb_gc_destroy(mrb_state*, mrb_gc *gc);
|
|
|
|
int mrb_core_init_protect(mrb_state *mrb, void (*body)(mrb_state *, void *), void *opaque);
|
|
|
|
static void
|
|
init_gc_and_core(mrb_state *mrb, void *opaque)
|
|
{
|
|
static const struct mrb_context mrb_context_zero = { 0 };
|
|
|
|
mrb_gc_init(mrb, &mrb->gc);
|
|
mrb->c = (struct mrb_context*)mrb_malloc(mrb, sizeof(struct mrb_context));
|
|
*mrb->c = mrb_context_zero;
|
|
mrb->root_c = mrb->c;
|
|
|
|
mrb_init_core(mrb);
|
|
}
|
|
|
|
MRB_API mrb_state*
|
|
mrb_open_core(mrb_allocf f, void *ud)
|
|
{
|
|
static const mrb_state mrb_state_zero = { 0 };
|
|
mrb_state *mrb;
|
|
|
|
if (f == NULL) f = mrb_default_allocf;
|
|
mrb = (mrb_state *)(f)(NULL, NULL, sizeof(mrb_state), ud);
|
|
if (mrb == NULL) return NULL;
|
|
|
|
*mrb = mrb_state_zero;
|
|
mrb->allocf_ud = ud;
|
|
mrb->allocf = f;
|
|
mrb->atexit_stack_len = 0;
|
|
|
|
if (mrb_core_init_protect(mrb, init_gc_and_core, NULL)) {
|
|
mrb_close(mrb);
|
|
return NULL;
|
|
}
|
|
|
|
return mrb;
|
|
}
|
|
|
|
void*
|
|
mrb_default_allocf(mrb_state *mrb, void *p, size_t size, void *ud)
|
|
{
|
|
if (size == 0) {
|
|
free(p);
|
|
return NULL;
|
|
}
|
|
else {
|
|
return realloc(p, size);
|
|
}
|
|
}
|
|
|
|
MRB_API mrb_state*
|
|
mrb_open(void)
|
|
{
|
|
mrb_state *mrb = mrb_open_allocf(mrb_default_allocf, NULL);
|
|
|
|
return mrb;
|
|
}
|
|
|
|
static void
|
|
init_mrbgems(mrb_state *mrb, void *opaque)
|
|
{
|
|
mrb_init_mrbgems(mrb);
|
|
}
|
|
|
|
MRB_API mrb_state*
|
|
mrb_open_allocf(mrb_allocf f, void *ud)
|
|
{
|
|
mrb_state *mrb = mrb_open_core(f, ud);
|
|
|
|
if (mrb == NULL) {
|
|
return NULL;
|
|
}
|
|
|
|
#ifndef DISABLE_GEMS
|
|
if (mrb_core_init_protect(mrb, init_mrbgems, NULL)) {
|
|
mrb_close(mrb);
|
|
return NULL;
|
|
}
|
|
mrb_gc_arena_restore(mrb, 0);
|
|
#endif
|
|
return mrb;
|
|
}
|
|
|
|
void mrb_free_symtbl(mrb_state *mrb);
|
|
|
|
void
|
|
mrb_irep_incref(mrb_state *mrb, mrb_irep *irep)
|
|
{
|
|
irep->refcnt++;
|
|
}
|
|
|
|
void
|
|
mrb_irep_decref(mrb_state *mrb, mrb_irep *irep)
|
|
{
|
|
irep->refcnt--;
|
|
if (irep->refcnt == 0) {
|
|
mrb_irep_free(mrb, irep);
|
|
}
|
|
}
|
|
|
|
void
|
|
mrb_irep_cutref(mrb_state *mrb, mrb_irep *irep)
|
|
{
|
|
mrb_irep *tmp;
|
|
int i;
|
|
|
|
for (i=0; i<irep->rlen; i++) {
|
|
tmp = irep->reps[i];
|
|
irep->reps[i] = NULL;
|
|
if (tmp) mrb_irep_decref(mrb, tmp);
|
|
}
|
|
}
|
|
|
|
void
|
|
mrb_irep_free(mrb_state *mrb, mrb_irep *irep)
|
|
{
|
|
int i;
|
|
|
|
if (!(irep->flags & MRB_ISEQ_NO_FREE))
|
|
mrb_free(mrb, (void*)irep->iseq);
|
|
if (irep->pool) for (i=0; i<irep->plen; i++) {
|
|
if (mrb_string_p(irep->pool[i])) {
|
|
mrb_gc_free_str(mrb, RSTRING(irep->pool[i]));
|
|
mrb_free(mrb, mrb_obj_ptr(irep->pool[i]));
|
|
}
|
|
#if defined(MRB_WORD_BOXING) && !defined(MRB_WITHOUT_FLOAT)
|
|
else if (mrb_float_p(irep->pool[i])) {
|
|
mrb_free(mrb, mrb_obj_ptr(irep->pool[i]));
|
|
}
|
|
#endif
|
|
}
|
|
mrb_free(mrb, irep->pool);
|
|
mrb_free(mrb, irep->syms);
|
|
if (irep->reps) {
|
|
for (i=0; i<irep->rlen; i++) {
|
|
if (irep->reps[i])
|
|
mrb_irep_decref(mrb, irep->reps[i]);
|
|
}
|
|
}
|
|
mrb_free(mrb, irep->reps);
|
|
mrb_free(mrb, irep->lv);
|
|
mrb_debug_info_free(mrb, irep->debug_info);
|
|
mrb_free(mrb, irep);
|
|
}
|
|
|
|
void mrb_free_backtrace(mrb_state *mrb);
|
|
|
|
MRB_API void
|
|
mrb_free_context(mrb_state *mrb, struct mrb_context *c)
|
|
{
|
|
if (!c) return;
|
|
mrb_free(mrb, c->stbase);
|
|
mrb_free(mrb, c->cibase);
|
|
mrb_free(mrb, c->rescue);
|
|
mrb_free(mrb, c->ensure);
|
|
mrb_free(mrb, c);
|
|
}
|
|
|
|
MRB_API void
|
|
mrb_close(mrb_state *mrb)
|
|
{
|
|
if (!mrb) return;
|
|
if (mrb->atexit_stack_len > 0) {
|
|
mrb_int i;
|
|
for (i = mrb->atexit_stack_len; i > 0; --i) {
|
|
mrb->atexit_stack[i - 1](mrb);
|
|
}
|
|
#ifndef MRB_FIXED_STATE_ATEXIT_STACK
|
|
mrb_free(mrb, mrb->atexit_stack);
|
|
#endif
|
|
}
|
|
|
|
/* free */
|
|
mrb_gc_destroy(mrb, &mrb->gc);
|
|
mrb_free_context(mrb, mrb->root_c);
|
|
mrb_gc_free_gv(mrb);
|
|
mrb_free_symtbl(mrb);
|
|
mrb_free(mrb, mrb);
|
|
}
|
|
|
|
MRB_API mrb_irep*
|
|
mrb_add_irep(mrb_state *mrb)
|
|
{
|
|
static const mrb_irep mrb_irep_zero = { 0 };
|
|
mrb_irep *irep;
|
|
|
|
irep = (mrb_irep *)mrb_malloc(mrb, sizeof(mrb_irep));
|
|
*irep = mrb_irep_zero;
|
|
irep->refcnt = 1;
|
|
|
|
return irep;
|
|
}
|
|
|
|
MRB_API mrb_value
|
|
mrb_top_self(mrb_state *mrb)
|
|
{
|
|
return mrb_obj_value(mrb->top_self);
|
|
}
|
|
|
|
MRB_API void
|
|
mrb_state_atexit(mrb_state *mrb, mrb_atexit_func f)
|
|
{
|
|
#ifdef MRB_FIXED_STATE_ATEXIT_STACK
|
|
if (mrb->atexit_stack_len + 1 > MRB_FIXED_STATE_ATEXIT_STACK_SIZE) {
|
|
mrb_raise(mrb, E_RUNTIME_ERROR, "exceeded fixed state atexit stack limit");
|
|
}
|
|
#else
|
|
size_t stack_size;
|
|
|
|
stack_size = sizeof(mrb_atexit_func) * (mrb->atexit_stack_len + 1);
|
|
if (mrb->atexit_stack_len == 0) {
|
|
mrb->atexit_stack = (mrb_atexit_func*)mrb_malloc(mrb, stack_size);
|
|
}
|
|
else {
|
|
mrb->atexit_stack = (mrb_atexit_func*)mrb_realloc(mrb, mrb->atexit_stack, stack_size);
|
|
}
|
|
#endif
|
|
|
|
mrb->atexit_stack[mrb->atexit_stack_len++] = f;
|
|
}
|