bendrissou · GitHub

Executing the following ruby script causes a heap-use-after-free error. This issue arises from recursive calls to group_by, compounded by the print instruction, which triggers unsafe memory access during object inspection.

d = [1, 2, 3, 4, 5]
d = d.group_by do
  d = d.group_by do
    print(d, " , ")
    d = d.group_by do
    end
  end
end

AddressSanitizer report:

==80793==ERROR: AddressSanitizer: heap-use-after-free on address 0xffff9ea038a8 at pc 0x0000007928e4 bp 0xffffea665610 sp 0xffffea665608
READ of size 8 at 0xffff9ea038a8 thread T0
    #0 0x7928e0 in mrb_print /home/benchmarks/mruby/program/mrbgems/mruby-print/src/print.c:55:21
    #1 0x557128 in mrb_vm_exec /home/benchmarks/mruby/program/src/vm.c:1938:16
    #2 0x67df44 in mrb_load_exec /home/benchmarks/mruby/program/mrbgems/mruby-compiler/core/parse.y:6920:7
    #3 0x67ed3c in mrb_load_detect_file_cxt /home/benchmarks/mruby/program/mrbgems/mruby-compiler/core/parse.y:6963:12
    #4 0x4bbc28 in main /home/benchmarks/mruby/program/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:353:11
    #5 0xffffa3183e0c in __libc_start_main /build/glibc-kCnsjY/glibc-2.31/csu/../csu/libc-start.c:308:16
    #6 0x421b68 in _start (/home/benchmarks/mruby/program/build/host/bin/mruby+0x421b68)
0xffff9ea038a8 is located 296 bytes inside of 1024-byte region [0xffff9ea03780,0xffff9ea03b80)
freed by thread T0 here:
    #0 0x48ecfc in realloc (/home/benchmarks/mruby/program/build/host/bin/mruby+0x48ecfc)
    #1 0x4fe790 in mrb_realloc_simple /home/benchmarks/mruby/program/src/gc.c:197:8
    #2 0x4ff09c in mrb_realloc /home/benchmarks/mruby/program/src/gc.c:211:8
    #3 0x52db3c in stack_extend_alloc /home/benchmarks/mruby/program/src/vm.c:179:37
    #4 0x52db3c in stack_extend /home/benchmarks/mruby/program/src/vm.c:196:5
    #5 0x535b10 in funcall_args_capture /home/benchmarks/mruby/program/src/vm.c:656:5
    #6 0x532f74 in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:723:5
    #7 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #8 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #9 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
    #10 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #11 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #12 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
    #13 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #14 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #15 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
    #16 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #17 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #18 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
    #19 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #20 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #21 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
    #22 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #23 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #24 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
    #25 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #26 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #27 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
    #28 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
    #29 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
    #30 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
previously allocated by thread T0 here:
    #0 0x48ecfc in realloc (/home/benchmarks/mruby/program/build/host/bin/mruby+0x48ecfc)
    #1 0x4fe790 in mrb_realloc_simple /home/benchmarks/mruby/program/src/gc.c:197:8
    #2 0x4ff09c in mrb_realloc /home/benchmarks/mruby/program/src/gc.c:211:8
    #3 0x534590 in stack_init /home/benchmarks/mruby/program/src/vm.c:119:27
    #4 0x539180 in mrb_vm_run /home/benchmarks/mruby/program/src/vm.c:1337:5
    #5 0x5f8cf8 in mrb_init_core /home/benchmarks/mruby/program/src/init.c:48:3
    #6 0x4c4980 in mrb_core_init_protect /home/benchmarks/mruby/program/src/error.c:562:5
    #7 0x5d75f0 in mrb_open_core /home/benchmarks/mruby/program/src/state.c:53:7
    #8 0x5d7a34 in mrb_open_allocf /home/benchmarks/mruby/program/src/state.c:80:20
    #9 0x4ba578 in main /home/benchmarks/mruby/program/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:279:20
    #10 0xffffa3183e0c in __libc_start_main /build/glibc-kCnsjY/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x421b68 in _start (/home/benchmarks/mruby/program/build/host/bin/mruby+0x421b68)
SUMMARY: AddressSanitizer: heap-use-after-free /home/benchmarks/mruby/program/mrbgems/mruby-print/src/print.c:55:21 in mrb_print
Shadow bytes around the buggy address:
  0x200ff3d406c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x200ff3d406d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff3d406e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff3d406f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x200ff3d40700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x200ff3d40710: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x200ff3d40720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x200ff3d40730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x200ff3d40740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x200ff3d40750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x200ff3d40760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==80793==ABORTING

Read the original on github.com ↗