Bug #22322: AddressSanitizer: use-after-poison in econv_description /ruby-src/build/../transcode.c

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

[[e-mail] (Yuancheng Jiang)]

The following program:

ec = Encoding::Converter.new("", "xml_attr_content_escape")
begin ec.dup.freeze; ec.clone(freeze: false); GC.start(full_mark: true, immediate_sweep: true); ObjectSpace.each_object(ec.class).first(50).each(&:inspect); rescue Exception; end  # dataflow fusion

makes the interpreter report:

=================================================================
==1596291==ERROR: AddressSanitizer: use-after-poison on address 0x79ce1cfff1f8 at pc 0x60e57424f1e5 bp 0x7ffd8f1a9020 sp 0x7ffd8f1a9018
READ of size 1 at 0x79ce1cfff1f8 thread T0
    #0 0x60e57424f1e4 in econv_description /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../transcode.c:2069:9
    #1 0x60e574254cfd in econv_inspect /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../transcode.c:3572:9
    #2 0x60e57430c9b9 in vm_call0_cfunc_with_frame /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:164:15
    #3 0x60e57430c9b9 in vm_call0_cfunc /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:178:12
    #4 0x60e57430c9b9 in vm_call0_body /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:229:15
    #5 0x60e57430f704 in vm_call0_cc /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:101:12
    #6 0x60e57430f704 in rb_call0 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:577:12
    #7 0x60e5742c0b7c in rb_call /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:896:12
    #8 0x60e5742c0b7c in rb_funcall_with_block_kw /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:1216:12
    #9 0x60e574313e8e in vm_yield_with_symbol /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:5291:16
    #10 0x60e5743134e1 in invoke_block_from_c_bh /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1912:16
    #11 0x60e5742c10b3 in vm_yield_with_cref /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1946:12
    #12 0x60e5742c10b3 in vm_yield /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1954:12
    #13 0x60e5742c10b3 in rb_ec_yield /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c
    #14 0x60e57437fa35 in rb_ary_each /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:2792:9
    #15 0x60e5742f720a in vm_call_cfunc_with_frame_ /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:3904:11
    #16 0x60e5742e14b9 in vm_call_method_each_type /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:4896:16
    #17 0x60e5742e0c4e in vm_call_method /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c
    #18 0x60e5742a59ea in vm_sendish /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:6283:15
    #19 0x60e5742a59ea in vm_exec_core /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../insns.def:864:11
    #20 0x60e57428dbe1 in rb_vm_exec /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:2881:22
    #21 0x60e573ee5c1c in rb_ec_exec_node /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../eval.c:299:9
    #22 0x60e573ee5c1c in ruby_r

To reproduce:

/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb

Commit:

3296d5c99ce005e4698fb27a405e01d766ad2647

Build configuration:

../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1"

Operating System:

Ubuntu 24.04 host, Docker ffe-ruby:latest

This bug was found by fusion-fuzz

[peterzhu2118 (Peter Zhu)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for this bug report. I have a fix here.

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed

Applied in changeset git|20ca4e1f647107df1a5ae75b514f20b587091405.

---

[Bug #22322] Take transcoder names from declared transcoders

Fix use-after-free of dangling pointers.

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

ruby_3_4 b82e5058907869051d336449dd67f16b007ad7b8 merged revision(s) 20ca4e1f647107df1a5ae75b514f20b587091405.