dearblue · GitHub

When built with conf.enable_debug and conf.defines << %w(MRB_GC_STRESS MRB_HEAP_PAGE_SIZE=169), the test in mruby-enumerator reports “Use-after-free”.
I went back through the commit log and found that the problem started with commit 5bd63d6 . However, I didn't see any problem with the code written.

I don't know where the tail of the cause is, but I will try to find out more.

% cat test_config.rb
MRuby::Build.new do
  toolchain
  enable_test
  enable_debug
  defines << %w(MRB_HEAP_PAGE_SIZE=169)
  defines << %w(MRB_GC_STRESS)
  enable_sanitizer "address,undefined"
  gem core: "mruby-enumerator"
  # gembox "full-core"
end
% rake -mv MRUBY_CONFIG=test_config.rb test
...SNIP...
Enumerator.class : .
Enumerator.superclass : .
Enumerator.new : .
Enumerator#initialize_copy : .
=================================================================
==72465==ERROR: AddressSanitizer: heap-use-after-free on address 0x525000033ff0 at pc 0x00000042fcc5 bp 0x7ffffffdce90 sp 0x7ffffffdce88
READ of size 4 at 0x525000033ff0 thread T0
    #0 0x42fcc4 in obj_free /var/tmp/mruby/src/gc.c:782:23
    #1 0x434de2 in incremental_sweep_phase /var/tmp/mruby/src/gc.c:1036:11
    #2 0x43174f in incremental_gc /var/tmp/mruby/src/gc.c:1112:20
    #3 0x42b41b in incremental_gc_finish /var/tmp/mruby/src/gc.c:1128:5
    #4 0x4242ea in mrb_full_gc /var/tmp/mruby/src/gc.c:1224:3
    #5 0x42529e in mrb_obj_alloc /var/tmp/mruby/src/gc.c:489:3
    #6 0x4f1ce9 in str_new /var/tmp/mruby/src/string.c:147:27
    #7 0x4f1bdc in mrb_str_new /var/tmp/mruby/src/string.c:187:24
    #8 0x5e07bc in mrb_vm_exec /var/tmp/mruby/src/vm.c:2839:19
    #9 0x567655 in mrb_vm_run /var/tmp/mruby/src/vm.c:1365:12
    #10 0x55e438 in mrb_top_run /var/tmp/mruby/src/vm.c:3135:10
    #11 0x456a7c in load_irep /var/tmp/mruby/src/load.c:682:10
    #12 0x4566fd in mrb_load_irep_cxt /var/tmp/mruby/src/load.c:690:10
    #13 0x456b18 in mrb_load_irep /var/tmp/mruby/src/load.c:702:10
    #14 0x3b23b9 in GENERATED_TMP_mrb_mruby_enumerator_gem_test /var/tmp/mruby/build/host/mrbgems/mruby-enumerator/gem_test.c:1448:3
    #15 0x3af9b5 in mrbgemtest_init /var/tmp/mruby/build/host/mrbgems/mruby-test/mrbtest.c:19:5
    #16 0x3ab09f in main /var/tmp/mruby/mrbgems/mruby-test/driver.c:299:3
    #17 0x8007f3a69 in __libc_start1 (/lib/libc.so.7+0x85a69)
    #18 0x2faa7f in _start /usr/src/lib/csu/amd64/crt1_s.S:83
0x525000033ff0 is located 7920 bytes inside of 8144-byte region [0x525000032100,0x5250000340d0)
freed by thread T0 here:
    #0 0x374476 in free /usr/src/contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
previously allocated by thread T0 here:
    #0 0x374817 in realloc /usr/src/contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
SUMMARY: AddressSanitizer: heap-use-after-free /var/tmp/mruby/src/gc.c:782:23 in obj_free
Shadow bytes around the buggy address:
  0x525000033d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x525000033d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x525000033e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x525000033e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x525000033f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x525000033f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
  0x525000034000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x525000034080: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x525000034100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x525000034180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x525000034200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==72465==ABORTING
...SNIP...

Read the original on github.com ↗