Heap buffer overflow

[clayton-shopify]

The following input demonstrates a crash:

def f
  g
ensure
  return while 0
end

class A
  f
rescue
end

ASAN diagnoses this as a heap buffer overflow:

==87844==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200001d954 at pc 0x000101ef268e bp 0x7fff5de6ca90 sp 0x7fff5de6ca88
READ of size 4 at 0x60200001d954 thread T0
    #0 0x101ef268d in mrb_vm_exec vm.c:966
    #1 0x101eee5a9 in mrb_vm_run vm.c:801
    #2 0x101f1f0c9 in mrb_top_run vm.c:2536
    #3 0x101fec915 in mrb_load_exec parse.y:5755
    #4 0x101fed725 in mrb_load_file_cxt parse.y:5764
    #5 0x101d8cbaa in main mruby.c:232
    #6 0x7fffb4357254 in start (libdyld.dylib+0x5254)

0x60200001d954 is located 0 bytes to the right of 4-byte region [0x60200001d950,0x60200001d954)
allocated by thread T0 here:
    #0 0x10212df87 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib+0x4af87)
    #1 0x101e84815 in mrb_default_allocf state.c:60
    #2 0x101e07e08 in mrb_realloc_simple gc.c:201
    #3 0x101faeba5 in codegen_realloc codegen.c:132
    #4 0x101fbeb9c in scope_finish codegen.c:2842
    #5 0x101fb56ce in lambda_body codegen.c:725
    #6 0x101fad8a7 in codegen codegen.c:2686
    #7 0x101f98cfd in codegen codegen.c:1254
    #8 0x101fb14f6 in scope_body codegen.c:737
    #9 0x101f9c81a in codegen codegen.c:1555
    #10 0x101f96261 in mrb_generate_code codegen.c:2954
    #11 0x101febd90 in mrb_load_exec parse.y:5732
    #12 0x101fed725 in mrb_load_file_cxt parse.y:5764
    #13 0x101d8cbaa in main mruby.c:232
    #14 0x7fffb4357254 in start (libdyld.dylib+0x5254)

SUMMARY: AddressSanitizer: heap-buffer-overflow vm.c:966 in mrb_vm_exec
Shadow bytes around the buggy address:
  0x1c0400003ad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400003ae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00 02
  0x1c0400003af0: fa fa 00 00 fa fa 00 fa fa fa 00 00 fa fa 00 fa
  0x1c0400003b00: fa fa 00 00 fa fa 00 02 fa fa 00 fa fa fa 00 04
  0x1c0400003b10: fa fa 00 00 fa fa fd fd fa fa 00 02 fa fa 00 04
=>0x1c0400003b20: fa fa 00 fa fa fa 00 fa fa fa[04]fa fa fa 00 04
  0x1c0400003b30: fa fa 00 02 fa fa 00 06 fa fa 00 fa fa fa 00 06
  0x1c0400003b40: fa fa 00 00 fa fa fd fd fa fa 00 00 fa fa 00 fa
  0x1c0400003b50: fa fa fd fd fa fa 00 00 fa fa fd fd fa fa fd fd
  0x1c0400003b60: fa fa 02 fa fa fa 02 fa fa fa 02 fa fa fa 00 02
  0x1c0400003b70: fa fa fd fd fa fa 00 02 fa fa 05 fa fa fa 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==87844==ABORTING
Abort trap: 6

This issue was reported by https://hackerone.com/titanous

[clayton-shopify]

The PoC looks similar to #3433, so maybe they are related.