* [ruby-core:94356] [Ruby master Bug#16105] heap-use-after-free in String#sub!
[not found] <redmine.issue-16105.20190814194109@ruby-lang.org>
@ 2019-08-14 19:41 ` joe
2019-08-18 7:22 ` [ruby-core:94415] " nagachika00
2019-08-26 16:49 ` [ruby-core:94582] " usa
2 siblings, 0 replies; 3+ messages in thread
From: joe @ 2019-08-14 19:41 UTC (permalink / raw)
To: ruby-core
Issue #16105 has been reported by bannable (Joe Truba).
----------------------------------------
Bug #16105: heap-use-after-free in String#sub!
https://bugs.ruby-lang.org/issues/16105
* Author: bannable (Joe Truba)
* Status: Open
* Priority: Normal
* Assignee:
* Target version:
* ruby -v: ruby 2.7.0dev (2019-08-14T18:22:07Z master d5c60214c4) [x86_64-linux]
* Backport: 2.5: UNKNOWN, 2.6: UNKNOWN
----------------------------------------
#15946 caught my eye, so I ran the reproducer there through a build with AddressSanitizer (ASAN) enabled. It looks like String#sub! still has some corruption going on even after the memmove change.
Reproducer:
```
a = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
b = a.dup
c = a.slice(1, 100)
b.sub!(c, b)
```
Crash:
```
=================================================================
==65063==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000095850 at pc 0x55a9c2dda9c1 bp 0x7ffc5a735af0 sp 0x7ffc5a735ae8
READ of size 35 at 0x604000095850 thread T0
#0 0x55a9c2dda9c0 in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5110
#1 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#2 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#3 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#4 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#5 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#6 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#7 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#8 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#9 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#10 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#11 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#12 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#13 0x55a9c2b07a6e in main main.c:50
#14 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#15 0x55a9c2b07868 (/home/jtruba/.rubies/ruby-trunk/bin/ruby+0xc7868)
0x604000095850 is located 0 bytes inside of 36-byte region [0x604000095850,0x604000095874)
freed by thread T0 here:
#0 0x7f73d45c99f6 in __interceptor_realloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x549f6)
#1 0x55a9c2b54c92 in objspace_xrealloc /home/jtruba/rubies/ruby-trunk/gc.c:9740
#2 0x55a9c2b5513a in ruby_sized_xrealloc2 /home/jtruba/rubies/ruby-trunk/gc.c:9953
#3 0x55a9c2b5516e in ruby_xrealloc2_body /home/jtruba/rubies/ruby-trunk/gc.c:9959
#4 0x55a9c2b5bd0b in ruby_xrealloc2 /home/jtruba/rubies/ruby-trunk/gc.c:11793
#5 0x55a9c2dda6eb in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5104
#6 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#7 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#8 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#9 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#10 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#11 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#12 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#13 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#14 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#15 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#16 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#17 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#18 0x55a9c2b07a6e in main main.c:50
#19 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
previously allocated by thread T0 here:
#0 0x7f73d45c973f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x55a9c2b54a64 in objspace_xmalloc0 /home/jtruba/rubies/ruby-trunk/gc.c:9698
#2 0x55a9c2b54ebd in ruby_xmalloc2_body /home/jtruba/rubies/ruby-trunk/gc.c:9905
#3 0x55a9c2b5bc94 in ruby_xmalloc2 /home/jtruba/rubies/ruby-trunk/gc.c:11763
#4 0x55a9c2dc6f53 in str_make_independent_expand /home/jtruba/rubies/ruby-trunk/string.c:2132
#5 0x55a9c2db899f in str_make_independent /home/jtruba/rubies/ruby-trunk/string.c:193
#6 0x55a9c2dc739d in rb_str_modify /home/jtruba/rubies/ruby-trunk/string.c:2152
#7 0x55a9c2dd9eec in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5089
#8 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#9 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#10 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#11 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#12 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#13 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#14 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#15 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#16 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#17 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#18 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#19 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#20 0x55a9c2b07a6e in main main.c:50
#21 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
SUMMARY: AddressSanitizer: heap-use-after-free /home/jtruba/rubies/ruby-trunk/string.c:5110 rb_str_sub_bang
Shadow bytes around the buggy address:
0x0c088000aab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c088000ab00: fa fa 00 00 00 00 05 fa fa fa[fd]fd fd fd fd fa
0x0c088000ab10: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 03
0x0c088000ab20: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 03 fa
0x0c088000ab30: fa fa 00 00 00 00 04 fa fa fa 00 00 00 00 00 05
0x0c088000ab40: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 06 fa
0x0c088000ab50: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
```
I compiled w/ ASAN as follows:
```
./configure CFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" LDFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" --prefix ~/.rubies/ruby-trunk --disable-install-doc --disable-install-rdoc
LDFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" CFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" ASAN_OPTIONS=detect_leaks=0 make
```
--
https://bugs.ruby-lang.org/
^ permalink raw reply [flat|nested] 3+ messages in thread
* [ruby-core:94415] [Ruby master Bug#16105] heap-use-after-free in String#sub!
[not found] <redmine.issue-16105.20190814194109@ruby-lang.org>
2019-08-14 19:41 ` [ruby-core:94356] [Ruby master Bug#16105] heap-use-after-free in String#sub! joe
@ 2019-08-18 7:22 ` nagachika00
2019-08-26 16:49 ` [ruby-core:94582] " usa
2 siblings, 0 replies; 3+ messages in thread
From: nagachika00 @ 2019-08-18 7:22 UTC (permalink / raw)
To: ruby-core
Issue #16105 has been updated by nagachika (Tomoyuki Chikanaga).
Backport changed from 2.5: REQUIRED, 2.6: REQUIRED to 2.5: REQUIRED, 2.6: DONE
ruby_2_6 r67747 merged revision(s) d5c33364e3c0efb15e11df417c925afee2cdb9c9.
----------------------------------------
Bug #16105: heap-use-after-free in String#sub!
https://bugs.ruby-lang.org/issues/16105#change-80837
* Author: bannable (Joe Truba)
* Status: Closed
* Priority: Normal
* Assignee:
* Target version:
* ruby -v: ruby 2.7.0dev (2019-08-14T18:22:07Z master d5c60214c4) [x86_64-linux]
* Backport: 2.5: REQUIRED, 2.6: DONE
----------------------------------------
#15946 caught my eye, so I ran the reproducer there through a build with AddressSanitizer (ASAN) enabled. It looks like String#sub! still has some corruption going on even after the memmove change.
Reproducer:
```
a = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
b = a.dup
c = a.slice(1, 100)
b.sub!(c, b)
```
Crash:
```
=================================================================
==65063==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000095850 at pc 0x55a9c2dda9c1 bp 0x7ffc5a735af0 sp 0x7ffc5a735ae8
READ of size 35 at 0x604000095850 thread T0
#0 0x55a9c2dda9c0 in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5110
#1 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#2 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#3 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#4 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#5 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#6 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#7 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#8 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#9 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#10 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#11 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#12 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#13 0x55a9c2b07a6e in main main.c:50
#14 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#15 0x55a9c2b07868 (/home/jtruba/.rubies/ruby-trunk/bin/ruby+0xc7868)
0x604000095850 is located 0 bytes inside of 36-byte region [0x604000095850,0x604000095874)
freed by thread T0 here:
#0 0x7f73d45c99f6 in __interceptor_realloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x549f6)
#1 0x55a9c2b54c92 in objspace_xrealloc /home/jtruba/rubies/ruby-trunk/gc.c:9740
#2 0x55a9c2b5513a in ruby_sized_xrealloc2 /home/jtruba/rubies/ruby-trunk/gc.c:9953
#3 0x55a9c2b5516e in ruby_xrealloc2_body /home/jtruba/rubies/ruby-trunk/gc.c:9959
#4 0x55a9c2b5bd0b in ruby_xrealloc2 /home/jtruba/rubies/ruby-trunk/gc.c:11793
#5 0x55a9c2dda6eb in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5104
#6 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#7 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#8 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#9 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#10 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#11 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#12 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#13 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#14 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#15 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#16 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#17 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#18 0x55a9c2b07a6e in main main.c:50
#19 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
previously allocated by thread T0 here:
#0 0x7f73d45c973f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x55a9c2b54a64 in objspace_xmalloc0 /home/jtruba/rubies/ruby-trunk/gc.c:9698
#2 0x55a9c2b54ebd in ruby_xmalloc2_body /home/jtruba/rubies/ruby-trunk/gc.c:9905
#3 0x55a9c2b5bc94 in ruby_xmalloc2 /home/jtruba/rubies/ruby-trunk/gc.c:11763
#4 0x55a9c2dc6f53 in str_make_independent_expand /home/jtruba/rubies/ruby-trunk/string.c:2132
#5 0x55a9c2db899f in str_make_independent /home/jtruba/rubies/ruby-trunk/string.c:193
#6 0x55a9c2dc739d in rb_str_modify /home/jtruba/rubies/ruby-trunk/string.c:2152
#7 0x55a9c2dd9eec in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5089
#8 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#9 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#10 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#11 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#12 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#13 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#14 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#15 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#16 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#17 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#18 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#19 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#20 0x55a9c2b07a6e in main main.c:50
#21 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
SUMMARY: AddressSanitizer: heap-use-after-free /home/jtruba/rubies/ruby-trunk/string.c:5110 rb_str_sub_bang
Shadow bytes around the buggy address:
0x0c088000aab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c088000ab00: fa fa 00 00 00 00 05 fa fa fa[fd]fd fd fd fd fa
0x0c088000ab10: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 03
0x0c088000ab20: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 03 fa
0x0c088000ab30: fa fa 00 00 00 00 04 fa fa fa 00 00 00 00 00 05
0x0c088000ab40: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 06 fa
0x0c088000ab50: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
```
I compiled w/ ASAN as follows:
```
./configure CFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" LDFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" --prefix ~/.rubies/ruby-trunk --disable-install-doc --disable-install-rdoc
LDFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" CFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" ASAN_OPTIONS=detect_leaks=0 make
```
--
https://bugs.ruby-lang.org/
^ permalink raw reply [flat|nested] 3+ messages in thread
* [ruby-core:94582] [Ruby master Bug#16105] heap-use-after-free in String#sub!
[not found] <redmine.issue-16105.20190814194109@ruby-lang.org>
2019-08-14 19:41 ` [ruby-core:94356] [Ruby master Bug#16105] heap-use-after-free in String#sub! joe
2019-08-18 7:22 ` [ruby-core:94415] " nagachika00
@ 2019-08-26 16:49 ` usa
2 siblings, 0 replies; 3+ messages in thread
From: usa @ 2019-08-26 16:49 UTC (permalink / raw)
To: ruby-core
Issue #16105 has been updated by usa (Usaku NAKAMURA).
Backport changed from 2.5: REQUIRED, 2.6: DONE to 2.5: DONE, 2.6: DONE
ruby_2_5 r67773 merged revision(s) d5c33364e3c0efb15e11df417c925afee2cdb9c9.
----------------------------------------
Bug #16105: heap-use-after-free in String#sub!
https://bugs.ruby-lang.org/issues/16105#change-81045
* Author: bannable (Joe Truba)
* Status: Closed
* Priority: Normal
* Assignee:
* Target version:
* ruby -v: ruby 2.7.0dev (2019-08-14T18:22:07Z master d5c60214c4) [x86_64-linux]
* Backport: 2.5: DONE, 2.6: DONE
----------------------------------------
#15946 caught my eye, so I ran the reproducer there through a build with AddressSanitizer (ASAN) enabled. It looks like String#sub! still has some corruption going on even after the memmove change.
Reproducer:
```
a = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
b = a.dup
c = a.slice(1, 100)
b.sub!(c, b)
```
Crash:
```
=================================================================
==65063==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000095850 at pc 0x55a9c2dda9c1 bp 0x7ffc5a735af0 sp 0x7ffc5a735ae8
READ of size 35 at 0x604000095850 thread T0
#0 0x55a9c2dda9c0 in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5110
#1 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#2 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#3 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#4 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#5 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#6 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#7 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#8 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#9 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#10 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#11 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#12 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#13 0x55a9c2b07a6e in main main.c:50
#14 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#15 0x55a9c2b07868 (/home/jtruba/.rubies/ruby-trunk/bin/ruby+0xc7868)
0x604000095850 is located 0 bytes inside of 36-byte region [0x604000095850,0x604000095874)
freed by thread T0 here:
#0 0x7f73d45c99f6 in __interceptor_realloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x549f6)
#1 0x55a9c2b54c92 in objspace_xrealloc /home/jtruba/rubies/ruby-trunk/gc.c:9740
#2 0x55a9c2b5513a in ruby_sized_xrealloc2 /home/jtruba/rubies/ruby-trunk/gc.c:9953
#3 0x55a9c2b5516e in ruby_xrealloc2_body /home/jtruba/rubies/ruby-trunk/gc.c:9959
#4 0x55a9c2b5bd0b in ruby_xrealloc2 /home/jtruba/rubies/ruby-trunk/gc.c:11793
#5 0x55a9c2dda6eb in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5104
#6 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#7 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#8 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#9 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#10 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#11 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#12 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#13 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#14 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#15 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#16 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#17 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#18 0x55a9c2b07a6e in main main.c:50
#19 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
previously allocated by thread T0 here:
#0 0x7f73d45c973f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x55a9c2b54a64 in objspace_xmalloc0 /home/jtruba/rubies/ruby-trunk/gc.c:9698
#2 0x55a9c2b54ebd in ruby_xmalloc2_body /home/jtruba/rubies/ruby-trunk/gc.c:9905
#3 0x55a9c2b5bc94 in ruby_xmalloc2 /home/jtruba/rubies/ruby-trunk/gc.c:11763
#4 0x55a9c2dc6f53 in str_make_independent_expand /home/jtruba/rubies/ruby-trunk/string.c:2132
#5 0x55a9c2db899f in str_make_independent /home/jtruba/rubies/ruby-trunk/string.c:193
#6 0x55a9c2dc739d in rb_str_modify /home/jtruba/rubies/ruby-trunk/string.c:2152
#7 0x55a9c2dd9eec in rb_str_sub_bang /home/jtruba/rubies/ruby-trunk/string.c:5089
#8 0x55a9c2e9b7b2 in call_cfunc_m1 /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2034
#9 0x55a9c2e9d642 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2200
#10 0x55a9c2e9d90a in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2218
#11 0x55a9c2ea0937 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2553
#12 0x55a9c2ea19b9 in vm_call_method /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2682
#13 0x55a9c2ea1e92 in vm_call_general /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:2726
#14 0x55a9c2ea5a2c in vm_sendish /home/jtruba/rubies/ruby-trunk/vm_insnhelper.c:3619
#15 0x55a9c2eb22b7 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:789
#16 0x55a9c2ed8418 in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1888
#17 0x55a9c2eda90d in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2147
#18 0x55a9c2b0ea10 in rb_ec_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:273
#19 0x55a9c2b0ed09 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:331
#20 0x55a9c2b07a6e in main main.c:50
#21 0x7f73d3407b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
SUMMARY: AddressSanitizer: heap-use-after-free /home/jtruba/rubies/ruby-trunk/string.c:5110 rb_str_sub_bang
Shadow bytes around the buggy address:
0x0c088000aab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c088000aaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c088000ab00: fa fa 00 00 00 00 05 fa fa fa[fd]fd fd fd fd fa
0x0c088000ab10: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 03
0x0c088000ab20: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 03 fa
0x0c088000ab30: fa fa 00 00 00 00 04 fa fa fa 00 00 00 00 00 05
0x0c088000ab40: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 06 fa
0x0c088000ab50: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
```
I compiled w/ ASAN as follows:
```
./configure CFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" LDFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" --prefix ~/.rubies/ruby-trunk --disable-install-doc --disable-install-rdoc
LDFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" CFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address" ASAN_OPTIONS=detect_leaks=0 make
```
--
https://bugs.ruby-lang.org/
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-08-26 16:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <redmine.issue-16105.20190814194109@ruby-lang.org>
2019-08-14 19:41 ` [ruby-core:94356] [Ruby master Bug#16105] heap-use-after-free in String#sub! joe
2019-08-18 7:22 ` [ruby-core:94415] " nagachika00
2019-08-26 16:49 ` [ruby-core:94582] " usa
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).