Project

General

Profile

Actions
Copy link

Bug #22240

open

Protect against SEGV caused by native extensions using rb_funcall between rb_protect and rb_jump_tag

Bug #22240: Protect against SEGV caused by native extensions using rb_funcall between rb_protect and rb_jump_tag

Added by rwstauner (Randy Stauner) 5 days ago. Updated about 18 hours ago.

Status:
Open
Assignee:
-
Target version:
-
ruby -v:
Backport:
3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED
[ruby-core:126364]

Description

It's possible for native extensions do something like

int state = 0;
rb_protect(some_func, Qnil, &state);
if (state) {
    rb_funcall(self, rb_intern("handler"), 0);
    rb_jump_tag(state);
}

If the ruby code in the rb_funcall has a rescue clause it will clear errinfo.

When rb_jump_tag flows to hook_before_rewind with errinfo as Qnil it currently will SEGV.

If I add a check to avoid the SEGV, the process then exits silently.

If a native extension puts us in this state, the original message is gone.

One thing we can do is detect this scenario and fabricate an exception.

I have a PR up with a possible solution for this but am looking for feedback on the exception type and message or alternative suggestions for handling.

I have reproduced this crash as far back as Ruby 3.3.

Actions
Copy link

Also available in: PDF Atom