New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Heap use-after-free in gc_mark_children #3633

Closed
clayton-shopify opened this Issue Apr 24, 2017 · 3 comments

Comments

Projects
None yet
2 participants
@clayton-shopify
Contributor

clayton-shopify commented Apr 24, 2017

The following input demonstrates a crash:

class NoMethodError
    def initialize(a,b,c)
        super&0 
        ensure e
    end
end

a

ASAN report:

==25264==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500000b1e8 at pc 0x000105a0a278 bp 0x7fff5a158430 sp 0x7fff5a158428
READ of size 4 at 0x62500000b1e8 thread T0
    #0 0x105a0a277 in gc_mark_children gc.c:655
    #1 0x105a092ff in gc_gray_mark gc.c:896
    #2 0x105a074e6 in incremental_marking_phase gc.c:991
    #3 0x105a06653 in incremental_gc gc.c:1095
    #4 0x105a0264c in incremental_gc_step gc.c:1130
    #5 0x105a0185c in mrb_incremental_gc gc.c:1174
    #6 0x105a011c8 in mrb_obj_alloc gc.c:508
    #7 0x1059c04e1 in mrb_instance_alloc (mruby:x86_64+0x1000404e1)
    #8 0x1059c09b3 in mrb_obj_new (mruby:x86_64+0x1000409b3)
    #9 0x1059e588d in mrb_exc_new_str (mruby:x86_64+0x10006588d)
    #10 0x105b1a034 in argnum_error (mruby:x86_64+0x10019a034)
    #11 0x105afa583 in mrb_vm_exec (mruby:x86_64+0x10017a583)
    #12 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #13 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #14 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #15 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #16 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #17 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #18 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #19 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #20 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #21 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #22 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #23 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #24 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #25 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #26 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #27 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #28 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #29 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #30 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #31 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #32 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #33 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #34 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #35 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #36 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #37 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #38 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #39 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #40 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #41 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #42 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #43 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #44 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #45 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #46 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #47 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #48 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #49 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #50 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #51 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #52 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #53 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #54 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #55 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #56 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #57 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #58 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #59 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #60 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #61 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #62 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #63 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #64 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #65 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #66 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #67 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #68 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #69 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #70 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #71 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #72 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #73 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #74 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #75 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #76 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #77 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #78 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #79 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #80 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #81 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #82 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #83 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #84 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #85 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #86 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #87 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #88 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #89 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #90 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #91 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #92 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #93 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #94 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #95 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #96 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #97 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #98 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #99 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #100 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #101 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #102 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #103 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #104 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #105 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #106 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #107 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #108 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #109 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #110 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #111 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #112 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #113 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #114 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #115 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #116 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #117 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #118 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #119 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #120 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #121 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #122 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #123 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #124 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #125 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #126 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #127 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #128 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #129 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #130 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #131 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #132 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #133 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #134 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #135 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #136 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #137 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #138 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #139 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #140 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #141 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #142 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #143 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #144 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #145 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #146 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #147 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #148 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #149 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #150 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #151 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #152 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #153 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #154 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #155 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #156 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #157 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #158 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #159 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #160 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #161 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #162 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #163 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #164 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #165 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #166 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #167 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #168 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #169 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #170 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #171 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #172 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #173 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #174 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #175 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #176 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #177 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #178 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #179 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #180 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #181 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #182 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #183 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #184 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #185 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #186 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #187 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #188 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #189 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #190 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #191 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #192 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #193 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #194 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #195 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #196 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #197 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #198 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #199 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #200 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #201 0x105b1b759 in mrb_top_run (mruby:x86_64+0x10019b759)
    #202 0x105becb95 in mrb_load_exec (mruby:x86_64+0x10026cb95)
    #203 0x105bed4e5 in mrb_load_file_cxt (mruby:x86_64+0x10026d4e5)
    #204 0x105982be6 in main mruby.c:227
    #205 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

0x62500000b1e8 is located 4328 bytes inside of 9824-byte region [0x62500000a100,0x62500000c760)
freed by thread T0 here:
    #0 0x105d96520 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56520)
    #1 0x105a7b8e5 in mrb_default_allocf (mruby:x86_64+0x1000fb8e5)
    #2 0x1059fc8e8 in mrb_realloc_simple gc.c:202
    #3 0x1059fcfce in mrb_realloc gc.c:216
    #4 0x105abb75f in sym_intern (mruby:x86_64+0x10013b75f)
    #5 0x105abbb19 in mrb_intern_static (mruby:x86_64+0x10013bb19)
    #6 0x105a40157 in read_irep_record_1 (mruby:x86_64+0x1000c0157)
    #7 0x105a3e1d4 in read_irep_record (mruby:x86_64+0x1000be1d4)
    #8 0x105a3e2bc in read_irep_record (mruby:x86_64+0x1000be2bc)
    #9 0x105a3d2e8 in read_section_irep (mruby:x86_64+0x1000bd2e8)
    #10 0x105a3a68b in read_irep (mruby:x86_64+0x1000ba68b)
    #11 0x105a3a2c4 in mrb_read_irep (mruby:x86_64+0x1000ba2c4)
    #12 0x105a3ab64 in mrb_load_irep_cxt (mruby:x86_64+0x1000bab64)
    #13 0x105a3bdaf in mrb_load_irep (mruby:x86_64+0x1000bbdaf)
    #14 0x105b8388f in GENERATED_TMP_mrb_mruby_object_ext_gem_init (mruby:x86_64+0x10020388f)
    #15 0x105c0c5d2 in mrb_init_mrbgems (mruby:x86_64+0x10028c5d2)
    #16 0x105a7ba71 in mrb_open_allocf (mruby:x86_64+0x1000fba71)
    #17 0x105a7ba17 in mrb_open (mruby:x86_64+0x1000fba17)
    #18 0x105981af8 in main mruby.c:171
    #19 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

previously allocated by thread T0 here:
    #0 0x105d96520 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56520)
    #1 0x105a7b8e5 in mrb_default_allocf (mruby:x86_64+0x1000fb8e5)
    #2 0x1059fc8e8 in mrb_realloc_simple gc.c:202
    #3 0x1059fcfce in mrb_realloc gc.c:216
    #4 0x105abb75f in sym_intern (mruby:x86_64+0x10013b75f)
    #5 0x105abbb19 in mrb_intern_static (mruby:x86_64+0x10013bb19)
    #6 0x105b5a1c4 in mrb_mruby_string_ext_gem_init (mruby:x86_64+0x1001da1c4)
    #7 0x105b6694f in GENERATED_TMP_mrb_mruby_string_ext_gem_init (mruby:x86_64+0x1001e694f)
    #8 0x105c0c58a in mrb_init_mrbgems (mruby:x86_64+0x10028c58a)
    #9 0x105a7ba71 in mrb_open_allocf (mruby:x86_64+0x1000fba71)
    #10 0x105a7ba17 in mrb_open (mruby:x86_64+0x1000fba17)
    #11 0x105981af8 in main mruby.c:171
    #12 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

SUMMARY: AddressSanitizer: heap-use-after-free gc.c:655 in gc_mark_children
Shadow bytes around the buggy address:
  0x1c4a000015e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a000015f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x1c4a00001630: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
  0x1c4a00001640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==25264==ABORTING
Abort trap: 6

This issue was reported by Dinko Galetic & Denis Kasak (https://hackerone.com/dgaletic).

@clayton-shopify

This comment has been minimized.

Show comment
Hide comment
@clayton-shopify

clayton-shopify Apr 26, 2017

Contributor

Just like #3549 (comment), this started crashing after e26e118 and was (mostly) fixed by cef523c, but now it overflows the C stack. Prior to e26e118 it exited cleanly with "stack level too deep".

Contributor

clayton-shopify commented Apr 26, 2017

Just like #3549 (comment), this started crashing after e26e118 and was (mostly) fixed by cef523c, but now it overflows the C stack. Prior to e26e118 it exited cleanly with "stack level too deep".

@matz

This comment has been minimized.

Show comment
Hide comment
@matz

matz Apr 26, 2017

Member

I have a different idea to fix the issue (deferring backtrace creation until error-printing). I'm working on it.

Member

matz commented Apr 26, 2017

I have a different idea to fix the issue (deferring backtrace creation until error-printing). I'm working on it.

@clayton-shopify

This comment has been minimized.

Show comment
Hide comment
@clayton-shopify

clayton-shopify Apr 27, 2017

Contributor

@matz I did a bisect and stack overflows started happening in 88cd807. The stack traces contain mrb_format so I suspect that commit is the cause.

Contributor

clayton-shopify commented Apr 27, 2017

@matz I did a bisect and stack overflows started happening in 88cd807. The stack traces contain mrb_format so I suspect that commit is the cause.

@matz matz closed this in 9644ad5 May 23, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment