Skip to content

Commit 0058bee

Browse files
authored
Fix heap-use-after-free in rb_getaddrinfo (#13856)
This change addresses the following ASAN error: ``` ==1973462==ERROR: AddressSanitizer: heap-use-after-free on address 0x5110002117dc at pc 0x749c307c8a65 bp 0x7ffc3af331d0 sp 0x7ffc3af331c8 READ of size 4 at 0x5110002117dc thread T0 #0 0x749c307c8a64 in rb_getaddrinfo /tmp/ruby/src/trunk_asan/ext/socket/raddrinfo.c:564:14 #1 0x749c307c8a64 in rsock_getaddrinfo /tmp/ruby/src/trunk_asan/ext/socket/raddrinfo.c:1008:21 #2 0x749c307cac48 in rsock_addrinfo /tmp/ruby/src/trunk_asan/ext/socket/raddrinfo.c:1049:12 #3 0x749c307b10ae in init_inetsock_internal /tmp/ruby/src/trunk_asan/ext/socket/ipsocket.c:62:23 #4 0x562c5b2e327e in rb_ensure /tmp/ruby/src/trunk_asan/eval.c:1080:18 #5 0x749c307aafd4 in rsock_init_inetsock /tmp/ruby/src/trunk_asan/ext/socket/ipsocket.c:1318:12 #6 0x749c307b3b78 in tcp_svr_init /tmp/ruby/src/trunk_asan/ext/socket/tcpserver.c:39:12 ``` Fixed to avoid accessing memory that has already been freed after calling `free_getaddrinfo_arg`.
1 parent a02dcbf commit 0058bee

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

ext/socket/raddrinfo.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -517,7 +517,7 @@ rb_getaddrinfo(const char *hostp, const char *portp, const struct addrinfo *hint
517517
{
518518
int retry;
519519
struct getaddrinfo_arg *arg;
520-
int err = 0, gai_errno = 0;
520+
int err = 0, gai_errno = 0, timedout = 0;
521521

522522
start:
523523
retry = 0;
@@ -548,6 +548,7 @@ rb_getaddrinfo(const char *hostp, const char *portp, const struct addrinfo *hint
548548
}
549549
else if (arg->cancelled) {
550550
retry = 1;
551+
timedout = arg->timedout;
551552
}
552553
else {
553554
// If already interrupted, rb_thread_call_without_gvl2 may return without calling wait_getaddrinfo.
@@ -561,7 +562,7 @@ rb_getaddrinfo(const char *hostp, const char *portp, const struct addrinfo *hint
561562

562563
if (need_free) free_getaddrinfo_arg(arg);
563564

564-
if (arg->timedout) {
565+
if (timedout) {
565566
VALUE errno_module = rb_const_get(rb_cObject, rb_intern("Errno"));
566567
VALUE etimedout_error = rb_const_get(errno_module, rb_intern("ETIMEDOUT"));
567568
rb_raise(etimedout_error, "user specified timeout");

0 commit comments

Comments
 (0)