Actions
Bug #16907
closedProbable use-after-free in VM assertion
Description
The following Ruby program fails with VM assertions enabled on OpenBSD (code taken from test_caller_to_enum
in test/ruby/test_backtrace.rb
):
def foo
return to_enum(__method__) unless block_given?
raise
yield 1
end
enum = foo
enum.next
This is due to the following assertion in rb_current_vm
in vm_core.h
:
VM_ASSERT(ruby_current_vm_ptr == NULL ||
ruby_current_execution_context_ptr == NULL ||
rb_ec_thread_ptr(GET_EC()) == NULL ||
rb_ec_vm_ptr(GET_EC()) == ruby_current_vm_ptr);
Adding some debugging code, rb_ec_vm_ptr(GET_EC())
is 0xdfdfdfdfdfdfdfdf
. This is the memory pattern that OpenBSD free(3) writes to memory in order to detect use-after-free. So it is quite likely that this is operating on freed memory.
My guess as to what is happening here is that the enumerator fiber stack is freed, but this VM assertion is still accessing the memory. However, that's just a guess, and not a particularly educated one. I am not sure how to fix it.
Actions
Like0
Like0Like0