Bug #13052: Array#combination segfaults if the Array is modified during iteration

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 2.1: UNKNOWN, 2.2: DONE, 2.3: DONE

[rhenium (Kazuki Yamaguchi)]

Array#combination and Array#repeated_combination segfault if the Array is modified from the invoked block.

Reproduce:

ary = *1..100
ary.combination(1) { |x| p x; ary.clear } #=> segfault
# or ary.repeated_combination(1) { |x| p x; ary.clear } #=> segfault

This is the same as [Bug #9939], but it didn't fix the case of the argument is 1.

• Status changed from Open to Closed

Applied in changeset r57119.

---

array.c: check array length every time after yielding

Since the Array may be modified during rb_yield(), the length before
invoking the block can't be trusted. Fix possible out-of-bounds read in
Array#combination and Array#repeated_combination.

It may better to make a defensive copy of the Array, but for now let's
follow what Array#permutation does. [ruby-core:78738] [Bug #13052]

[usa (Usaku NAKAMURA)]

• Backport changed from 2.1: UNKNOWN, 2.2: REQUIRED, 2.3: REQUIRED to 2.1: UNKNOWN, 2.2: DONE, 2.3: REQUIRED

ruby_2_2 r57220 merged revision(s) 57119.

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.1: UNKNOWN, 2.2: DONE, 2.3: REQUIRED to 2.1: UNKNOWN, 2.2: DONE, 2.3: DONE

ruby_2_3 r57350 merged revision(s) 57119.