Executing the following ruby script causes a heap-use-after-free error. This issue arises from recursive calls to group_by, compounded by the print instruction, which triggers unsafe memory access during object inspection.
d = [1, 2, 3, 4, 5]
d = d.group_by do
d = d.group_by do
print(d, " , ")
d = d.group_by do
end
end
end
AddressSanitizer report:
==80793==ERROR: AddressSanitizer: heap-use-after-free on address 0xffff9ea038a8 at pc 0x0000007928e4 bp 0xffffea665610 sp 0xffffea665608
READ of size 8 at 0xffff9ea038a8 thread T0
#0 0x7928e0 in mrb_print /home/benchmarks/mruby/program/mrbgems/mruby-print/src/print.c:55:21
#1 0x557128 in mrb_vm_exec /home/benchmarks/mruby/program/src/vm.c:1938:16
#2 0x67df44 in mrb_load_exec /home/benchmarks/mruby/program/mrbgems/mruby-compiler/core/parse.y:6920:7
#3 0x67ed3c in mrb_load_detect_file_cxt /home/benchmarks/mruby/program/mrbgems/mruby-compiler/core/parse.y:6963:12
#4 0x4bbc28 in main /home/benchmarks/mruby/program/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:353:11
#5 0xffffa3183e0c in __libc_start_main /build/glibc-kCnsjY/glibc-2.31/csu/../csu/libc-start.c:308:16
#6 0x421b68 in _start (/home/benchmarks/mruby/program/build/host/bin/mruby+0x421b68)
0xffff9ea038a8 is located 296 bytes inside of 1024-byte region [0xffff9ea03780,0xffff9ea03b80)
freed by thread T0 here:
#0 0x48ecfc in realloc (/home/benchmarks/mruby/program/build/host/bin/mruby+0x48ecfc)
#1 0x4fe790 in mrb_realloc_simple /home/benchmarks/mruby/program/src/gc.c:197:8
#2 0x4ff09c in mrb_realloc /home/benchmarks/mruby/program/src/gc.c:211:8
#3 0x52db3c in stack_extend_alloc /home/benchmarks/mruby/program/src/vm.c:179:37
#4 0x52db3c in stack_extend /home/benchmarks/mruby/program/src/vm.c:196:5
#5 0x535b10 in funcall_args_capture /home/benchmarks/mruby/program/src/vm.c:656:5
#6 0x532f74 in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:723:5
#7 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#8 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#9 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
#10 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#11 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#12 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
#13 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#14 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#15 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
#16 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#17 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#18 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
#19 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#20 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#21 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
#22 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#23 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#24 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
#25 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#26 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#27 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
#28 0x4c065c in mrb_inspect /home/benchmarks/mruby/program/src/object.c:638:17
#29 0x5278bc in mrb_ary_to_s /home/benchmarks/mruby/program/src/array.c:1402:31
#30 0x53357c in mrb_funcall_with_block /home/benchmarks/mruby/program/src/vm.c:737:13
previously allocated by thread T0 here:
#0 0x48ecfc in realloc (/home/benchmarks/mruby/program/build/host/bin/mruby+0x48ecfc)
#1 0x4fe790 in mrb_realloc_simple /home/benchmarks/mruby/program/src/gc.c:197:8
#2 0x4ff09c in mrb_realloc /home/benchmarks/mruby/program/src/gc.c:211:8
#3 0x534590 in stack_init /home/benchmarks/mruby/program/src/vm.c:119:27
#4 0x539180 in mrb_vm_run /home/benchmarks/mruby/program/src/vm.c:1337:5
#5 0x5f8cf8 in mrb_init_core /home/benchmarks/mruby/program/src/init.c:48:3
#6 0x4c4980 in mrb_core_init_protect /home/benchmarks/mruby/program/src/error.c:562:5
#7 0x5d75f0 in mrb_open_core /home/benchmarks/mruby/program/src/state.c:53:7
#8 0x5d7a34 in mrb_open_allocf /home/benchmarks/mruby/program/src/state.c:80:20
#9 0x4ba578 in main /home/benchmarks/mruby/program/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:279:20
#10 0xffffa3183e0c in __libc_start_main /build/glibc-kCnsjY/glibc-2.31/csu/../csu/libc-start.c:308:16
#11 0x421b68 in _start (/home/benchmarks/mruby/program/build/host/bin/mruby+0x421b68)
SUMMARY: AddressSanitizer: heap-use-after-free /home/benchmarks/mruby/program/mrbgems/mruby-print/src/print.c:55:21 in mrb_print
Shadow bytes around the buggy address:
0x200ff3d406c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff3d406d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff3d406e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff3d406f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff3d40700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x200ff3d40710: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
0x200ff3d40720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff3d40730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff3d40740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff3d40750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff3d40760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==80793==ABORTING