Bug #9157: rb_readlink() calls rb_str_modify_expand() too early

• Status: Closed
• Assignee: -
• Target version: 2.1.0
• ruby -v: ruby 2.0.0p353 (2013-11-22) [x86_64-linux]
• Backport: 1.9.3: DONTNEED, 2.0.0: DONE

[nowacki (Maciek Nowacki)]

If rb_readlink() (file.c) is called on a long symlink, Ruby tends to crash. This is present in -trunk. The problem is that the rb_str_modify_expand() statement is incorrectly placed before the statement 'size*=2'. Here is a patch:

--- - 2013-11-25 22:10:59.694183795 -0700
+++ file.c 2013-11-25 22:10:03.076352889 -0700
@@ -2529,8 +2529,8 @@
|| (rv < 0 && errno == ERANGE) /* quirky behavior of GPFS */
#endif
) {

• rb_str_modify_expand(v, size);
  size *= 2;

• rb_str_modify_expand(v, size);
  }
  if (rv < 0) {
  rb_str_resize(v, 0);

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed
• % Done changed from 0 to 100

This issue was solved with changeset r43853.
Maciek, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.

---

file.c: fix buffer overflow

• file.c (rb_readlink): fix buffer overflow on a long symlink. since
  rb_str_modify_expand() expands from its length but not its capacity,
  need to set the length properly for each expansion.
  [ruby-core:58592] [Bug #9157]

[nobu (Nobuyoshi Nakada)]

• Backport changed from 1.9.3: UNKNOWN, 2.0.0: UNKNOWN to 1.9.3: DONTNEED, 2.0.0: REQUIRED

[nowacki (Maciek Nowacki)]

nobu (Nobuyoshi Nakada) wrote:

This issue was solved with changeset r43853.

Ah, I didn't realize that rb_str_modify_expand() takes a difference as its argument, not the total buffer length. This works because the function doubles the buffer size, which is the same as adding as much buffer capacity as is already present (size before *=2). My proposed fix simply made the problem less obvious. Interesting.

[vpereira (Victor Pereira)]

does it deserves a CVE?

[nobu (Nobuyoshi Nakada)]

No, just a usual bug which aborts by local filesystem access.

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 1.9.3: DONTNEED, 2.0.0: REQUIRED to 1.9.3: DONTNEED, 2.0.0: DONE

r43853 was backported to ruby_2_0_0 branch at r43959.