Backport #7402

Avoid calling methods on user objects from segfault handler

Added by Charlie Somerville over 1 year ago. Updated over 1 year ago.

[ruby-core:49573]
Status:Closed
Priority:Normal
Assignee:Usaku NAKAMURA

Description

When the segfault handler is listing loaded features, it iterates through $LOADEDFEATURES and calls StringValueCStr() on each item. This in turn calls #tostr on the object.

If a #tostr method is defined on a non-TSTRING, it is possible to have code run during the segfault handler. If an exception is raised or a tag is thrown, it is possible to escape the segfault handler and recover from a segmentation fault.

I've attached a patch that checks if an item in $LOADEDFEATURES is a TSTRING, and calls rbanyto_s() if not. This will avoid calling any methods which could potentially call back into Ruby-land.

avoid-calling-methods-in-segfault-handler.patch Magnifier (658 Bytes) Charlie Somerville, 11/19/2012 06:33 PM

History

#1 Updated by Yusuke Endoh over 1 year ago

  • Status changed from Open to Assigned
  • Assignee set to Koichi Sasada
  • Target version set to 2.0.0

#2 Updated by Koichi Sasada over 1 year ago

  • Assignee changed from Koichi Sasada to Nobuyoshi Nakada

nobu, could you check it?

#3 Updated by Nobuyoshi Nakada over 1 year ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

This issue was solved with changeset r38041.
Charlie, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.


vm_dump.c: no methods in segv handler

  • vmdump.c (rbvm_bugreport): get rid of calling methods in sigsegv handler. based on a patch by charliesome (Charlie Somerville) [Bug #7402]

#4 Updated by Nobuyoshi Nakada over 1 year ago

  • Tracker changed from Bug to Backport
  • Project changed from ruby-trunk to Backport93
  • Status changed from Closed to Assigned
  • Assignee changed from Nobuyoshi Nakada to Usaku NAKAMURA
  • Target version deleted (2.0.0)

#5 Updated by Yui NARUSE over 1 year ago

  • Status changed from Assigned to Closed

r38335 fixed testing issue: it generates garbage core file.

Also available in: Atom PDF