Project

General

Profile

Actions
Copy link

Bug #22409

open

ASan UAF and Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing

Bug #22409: ASan UAF and Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing

Added by 0599jiangyc@gmail.com (Yuancheng Jiang) about 3 hours ago. Updated about 1 hour ago.

Status:
Open
Assignee:
-
Target version:
-
ruby -v:
Backport:
3.3: DONTNEED, 3.4: DONTNEED, 4.0: DONTNEED
[ruby-core:126974]

Description

The following code:

pr = proc {|a=1,b=1,c=1,d=1,e=1,f=1,g=1,h=1,i=1,j=1| pr.call }
40.times do |k|
  eval((0...k).map { "v#{_1}=0;" }.join + "begin; pr.call; rescue SystemStackError => e; e.backtrace; end")
end
p :survived

Resulted in this output:

../gc.c:1135: Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing
ruby 4.1.0dev (2026-10-07) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
c:6555 p:-11149735210633 s:85178 e:005177 l:n b:---- r:(nil) BLOCK
c:6554 p:0035 s:85165 e:005164 l:n b:---- r:(nil) BLOCK  min.rb:1
c:6553 p:0035 s:85152 e:005151 l:n b:---- r:(nil) BLOCK  min.rb:1
...

and ASan:

==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000029780
READ of size 8 at 0x503000029780 thread T0
    #0 succ_index_lookup iseq.c:4611:16
    #1 get_insn_info_succinct_bitvector iseq.c:2479:17
    #2 get_insn_info iseq.c:2487:12
    #3 rb_iseq_line_no iseq.c:2562:48
    #4 calc_pos vm_backtrace.c:80:31
    #5 calc_lineno vm_backtrace.c:92:9
    #6 location_to_str vm_backtrace.c:749:18
    #7 location_to_str_dmyarg vm_backtrace.c:1115:12
    #8 backtrace_collect vm_backtrace.c:1106:28
    #9 backtrace_to_str_ary vm_backtrace.c:1124:9
    #10 rb_backtrace_to_str_ary vm_backtrace.c:1136:9
    #11 vm_call_cfunc_with_frame_ vm_insnhelper.c:3904:11

This bug was found by fusion-fuzz

Actions
Copy link

Also available in: PDF Atom