-
Notifications
You must be signed in to change notification settings - Fork 838
Add alias support for mruby-method and mruby-proc-ext #6879
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -419,6 +419,15 @@ mrb_proc_arity(const struct RProc *p) | |
| mrb_aspec aspec; | ||
| int ma, op, ra, pa, arity; | ||
|
|
||
| /* Resolve alias procs first: an alias carries body.mid (a symbol), not an | ||
| irep, with `upper` pointing at the original proc. Without this the irep | ||
| branch below reads body.mid as an mrb_irep* and dereferences it -> SEGV. | ||
| Mirrors the guard already present in mrb_proc_source_location / mrb_proc_eql. */ | ||
| while (p && MRB_PROC_ALIAS_P(p)) { | ||
| p = p->upper; | ||
| } | ||
| if (!p) return 0; | ||
|
Comment on lines
+426
to
+429
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Resolving aliases in
Please consider adding alias resolution guards to |
||
|
|
||
| if (MRB_PROC_CFUNC_P(p)) { | ||
| uint32_t caspec_bits = p->flags & MRB_PROC_CASPEC_MASK; | ||
| if (caspec_bits != 0) { | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While resolving aliases in
mrb_proc_parameterssuccessfully prevents a SEGV here,proc_inspect(lines 103–132) in the same file suffers from the exact same vulnerability. Inproc_inspect, if!MRB_PROC_CFUNC_P(p)is true, it directly accessesp->body.irepand passes it tomrb_debug_get_position. For an alias proc,body.irepis actuallybody.mid(a symbol), which will cause a misaligned read or SEGV when dereferenced.Please consider resolving aliases in
proc_inspectas well, for example: