mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00

Files

T

HASUMI Hitoshi 4035e42a39 Fix uninitialized variable in io_gets causing segmentation fault

This patch fixs a critical segmentation fault in `io_gets` function caused by an uninitialized limit variable.

This bug may specifically heppen when:
- MicroRuby with task scheduler, which I'm implementing, enabled

## Root Cause Analysis

When `io_gets` is called without arguments (argc=0), the local variable `limit` remains uninitialized on the stack.
I guess that this uninitialized memory often contains leftover heap addresses from previous stack frames.

### The problematic flow:

1. `mrb_get_args(mrb, "|o?i?", &rs, &rs_given, &limit, &limit_given)` with 0 arguments
2. `limit_given = FALSE` but limit contains garbage heap address
3. Looks like later processing truncates this address, creating invalid pointer 0xffff0000
4. This value gets pushed onto VM stack during string operations
5. Garbage collector attempts to mark 0xffff0000 as valid object pointer
6. SIGSEGV in mrb_gc_mark() at gc.c:748

    ```
    Program received signal SIGSEGV, Segmentation fault.
    0x00005c8bebffa95c in mrb_gc_mark (mrb=0x5c8bec2836c8 <heap_pool+728>, obj=0xffff0000)
        at .../gc.c:748
    748       if (!is_white(obj)) return;
    #1  mark_context_stack (mrb=0x5c8bec2836c8 <heap_pool+728>, c=0x5c8bec2b4a50 <heap_pool+202336>)
        at .../gc.c:555
    555       mrb_gc_mark(mrb, mrb_basic_ptr(v));
    ```

## Solution

I couldn't figure out the exact mechanism of the issue. Anyway, initializing the limit variable to zero could prevent invalid garbage stack memory:

```c
mrb_int limit = 0;  // Explicit initialization
```

## Files Changed

- mrbgems/picoruby-mruby/lib/mruby/mrbgems/mruby-io/src/io.c

2025-08-22 17:37:59 +09:00

include/mruby/ext

Change MRB_WITH_IO_PREAD_PWRITE configuration name

2024-12-12 22:18:34 +09:00

mrblib

fixup! mruby-io: add filetest call-seq documentation to file test methods

2025-08-19 10:06:18 +09:00

src

Fix uninitialized variable in io_gets causing segmentation fault

2025-08-22 17:37:59 +09:00

test

File.basename: add support for suffix removal and enhance tests

2025-06-23 22:49:43 +00:00

mrbgem.rake

mruby-io: define HAVE_MRUBY_IO_GEM if present; ref #6466

2025-01-14 13:24:16 +09:00

README.md

mruby-io (mrb_file__gethome): allow avoiding getpwnam(3); ref #5358

2024-09-03 15:27:29 +09:00

README.md

mruby-io

IO and File classes for mruby

Installation

Add the line below to your build configuration.

  conf.gem core: 'mruby-io'

Implemented methods

IO

https://doc.ruby-lang.org/ja/1.9.3/class/IO.html

method	mruby-io	memo
IO.binread
IO.binwrite
IO.copy_stream
IO.new, IO.for_fd, IO.open	o
IO.foreach
IO.pipe	o
IO.popen	o
IO.read	o
IO.readlines
IO.select	o
IO.sysopen	o
IO.try_convert
IO.write
IO#<<
IO#advise
IO#autoclose=
IO#autoclose?
IO#binmode
IO#binmode?
IO#bytes		obsolete
IO#chars		obsolete
IO#clone, IO#dup	o
IO#close	o
IO#close_on_exec=	o
IO#close_on_exec?	o
IO#close_read
IO#close_write
IO#closed?	o
IO#codepoints		obsolete
IO#each_byte	o
IO#each_char	o
IO#each_codepoint
IO#each_line	o
IO#eof, IO#eof?	o
IO#external_encoding
IO#fcntl
IO#fdatasync
IO#fileno, IO#to_i	o
IO#flush	o
IO#fsync
IO#getbyte	o
IO#getc	o
IO#gets	o
IO#internal_encoding
IO#ioctl
IO#isatty, IO#tty?	o
IO#lineno
IO#lineno=
IO#lines		obsolete
IO#pid	o
IO#pos, IO#tell	o
IO#pos=	o
IO#print	o
IO#printf	o
IO#putc
IO#puts	o
IO#read	o
IO#read_nonblock
IO#readbyte	o
IO#readchar	o
IO#readline	o
IO#readlines	o
IO#readpartial
IO#reopen
IO#rewind
IO#seek	o
IO#set_encoding
IO#stat
IO#sync	o
IO#sync=	o
IO#sysread	o
IO#sysseek	o
IO#syswrite	o
IO#to_io
IO#ungetbyte	o
IO#ungetc	o
IO#write	o
IO#write_nonblock

File

https://doc.ruby-lang.org/ja/1.9.3/class/File.html

method	mruby-io	memo
File.absolute_path
File.atime
File.basename	o
File.blockdev?		FileTest
File.chardev?		FileTest
File.chmod	o
File.chown
File.ctime
File.delete, File.unlink	o
File.directory?	o	FileTest
File.dirname	o
File.executable?		FileTest
File.executable_real?		FileTest
File.exist?, exists?	o	FileTest
File.expand_path	o
File.extname	o
File.file?	o	FileTest
File.fnmatch, File.fnmatch?
File.ftype
File.grpowned?		FileTest
File.identical?		FileTest
File.join	o
File.lchmod
File.lchown
File.link
File.lstat
File.mtime
File.new, File.open	o
File.owned?		FileTest
File.path
File.pipe?	o	FileTest
File.readable?		FileTest
File.readable_real?		FileTest
File.readlink	o
File.realdirpath
File.realpath	o
File.rename	o
File.setgid?		FileTest
File.setuid?		FileTest
File.size	o
File.size?	o	FileTest
File.socket?	o	FileTest
File.split
File.stat
File.sticky?		FileTest
File.symlink
File.symlink?	o	FileTest
File.truncate
File.umask	o
File.utime
File.world_readable?
File.world_writable?
File.writable?		FileTest
File.writable_real?		FileTest
File.zero?	o	FileTest
File#atime	o
File#chmod
File#chown
File#ctime	o
File#flock	o
File#lstat
File#mtime	o
File#path	o
File#size
File#truncate

Porting Note

If your (non Windows) platform does not support getpwnam(3) for some reason, define MRB_IO_NO_PWNAM. See mruby#5358.

License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.