Heap use-after-free in mrb_ary_ref

[clayton-shopify]

The following input to mirb demonstrates a crash: 215447.txt

(Note that this input must be supplied to mirb, not mruby.)

ASAN report:

==5435==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200003fc50 at pc 0x00010fed42f8 bp 0x7fff501204f0 sp 0x7fff5011fca0
READ of size 16 at 0x60200003fc50 thread T0
    #0 0x10fed42f7 in __asan_memcpy (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4d2f7)
    #1 0x10fad7894 in mrb_ary_ref array.c:552
    #2 0x10fae13f8 in mrb_ary_aget array.c:753
    #3 0x10fc3cca0 in mrb_vm_exec (mirb:x86_64+0x100170ca0)
    #4 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #5 0x10fc2b06e in mrb_run (mirb:x86_64+0x10015f06e)
    #6 0x10fc289b7 in mrb_funcall_with_block (mirb:x86_64+0x10015c9b7)
    #7 0x10fc25387 in mrb_funcall_argv (mirb:x86_64+0x100159387)
    #8 0x10fb76c02 in mrb_method_missing (mirb:x86_64+0x1000aac02)
    #9 0x10fc3bd45 in mrb_vm_exec (mirb:x86_64+0x10016fd45)
    #10 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #11 0x10face7f9 in main mirb.c:549
    #12 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

0x60200003fc50 is located 0 bytes inside of 16-byte region [0x60200003fc50,0x60200003fc60)
freed by thread T0 here:
    #0 0x10fedd356 in wrap_free (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56356)
    #1 0x10fbc757b in mrb_default_allocf (mirb:x86_64+0x1000fb57b)
    #2 0x10fb4a519 in mrb_free gc.c:268
    #3 0x10fb4b4ea in obj_free gc.c:778
    #4 0x10fb5461b in incremental_sweep_phase gc.c:1030
    #5 0x10fb52ebc in incremental_gc gc.c:1096
    #6 0x10fb4ee86 in incremental_gc_until gc.c:1112
    #7 0x10fb4e19a in mrb_incremental_gc gc.c:1163
    #8 0x10fb4db18 in mrb_obj_alloc gc.c:507
    #9 0x10fad19c3 in ary_new_capa array.c:30
    #10 0x10fad231a in mrb_ary_new_from_values array.c:78
    #11 0x10fc5753f in mrb_vm_exec (mirb:x86_64+0x10018b53f)
    #12 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #13 0x10fc2b06e in mrb_run (mirb:x86_64+0x10015f06e)
    #14 0x10fc289b7 in mrb_funcall_with_block (mirb:x86_64+0x10015c9b7)
    #15 0x10fc25387 in mrb_funcall_argv (mirb:x86_64+0x100159387)
    #16 0x10fb76c02 in mrb_method_missing (mirb:x86_64+0x1000aac02)
    #17 0x10fc3bd45 in mrb_vm_exec (mirb:x86_64+0x10016fd45)
    #18 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #19 0x10face7f9 in main mirb.c:549
    #20 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

previously allocated by thread T0 here:
    #0 0x10fedd520 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56520)
    #1 0x10fbc7595 in mrb_default_allocf (mirb:x86_64+0x1000fb595)
    #2 0x10fb49238 in mrb_realloc_simple gc.c:201
    #3 0x10fb4991e in mrb_realloc gc.c:215
    #4 0x10fb4a3a3 in mrb_malloc gc.c:236
    #5 0x10fad19d4 in ary_new_capa array.c:31
    #6 0x10fad231a in mrb_ary_new_from_values array.c:78
    #7 0x10fc5753f in mrb_vm_exec (mirb:x86_64+0x10018b53f)
    #8 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #9 0x10face7f9 in main mirb.c:549
    #10 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

SUMMARY: AddressSanitizer: heap-use-after-free (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4d2f7) in __asan_memcpy
Shadow bytes around the buggy address:
  0x1c0400007f30: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x1c0400007f40: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x1c0400007f50: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x1c0400007f60: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x1c0400007f70: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
=>0x1c0400007f80: fa fa fd fd fa fa fd fd fa fa[fd]fd fa fa fd fa
  0x1c0400007f90: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd
  0x1c0400007fa0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x1c0400007fb0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
  0x1c0400007fc0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x1c0400007fd0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==5435==ABORTING
Abort trap: 6

This seems to happen because an array allocated on line 54 of the input gets garbage collected too soon.

This issue was reported by https://hackerone.com/ston3

[clayton-shopify]

@matz This issue needs to be re-opened since the change was reverted. The crash is still present in the latest master.