Skip to content

Stop reading past the end of ivptr array #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vmg merged 2 commits into from
Nov 23, 2016
Merged

Stop reading past the end of ivptr array #35

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5827d8e
add tag v2_3_1
nagachika Apr 25, 2016
a992d79
Stop reading past the end of `ivptr` array
tenderlove Nov 22, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Stop reading past the end of ivptr array 
If you have code like this:

```ruby
class A
  def initialize
    @A = nil
    @b = nil
    @c = nil
    @d = nil
    @e = nil
  end
end

x = A.new
y = x.clone
100.times { |z| x.instance_variable_set(:"@foo#{z}", nil) }
puts y.inspect
```

`x` and `y` will share `iv_index_tbl` hashes.  However, the size of the
hash will grow larger than the number if entries in `ivptr` in `y`.
Before this commit, `rb_ivar_count` would use the size of the hash to
determine how far to read in to the array, but this means that it could
read past the end of the array and cause the program to segv
  • Loading branch information
@tenderlove
tenderlove committed Nov 22, 2016
commit a992d79f56ad6107e72d279343766f0154f90183
2 changes: 1 addition & 1 deletion variable.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1605,7 +1605,7 @@ rb_ivar_count(VALUE obj)
switch (BUILTIN_TYPE(obj)) {
case T_OBJECT:
if ((tbl = ROBJECT_IV_INDEX_TBL(obj)) != 0) {
st_index_t i, count, num = tbl->num_entries;
st_index_t i, count, num = ROBJECT_NUMIV(obj);
const VALUE *const ivptr = ROBJECT_IVPTR(obj);
for (i = count = 0; i < num; ++i) {
if (ivptr[i] != Qundef) {
Expand Down