1. 13 Feb, 2021 7 commits
  2. 12 Feb, 2021 17 commits
  3. 10 Feb, 2021 5 commits
    • Yukihiro "Matz" Matsumoto's avatar
      Merge pull request #5333 from shuujii/fix-heap-buffer-overflow-for-small-Hash-HT-in-Hash-rehash · d178e147
      Yukihiro "Matz" Matsumoto authored
      Fix heap-buffer-overflow for small `Hash` (HT) in `Hash#rehash`
      d178e147
    • Yukihiro "Matz" Matsumoto's avatar
      5735d7c2
    • Yukihiro "Matz" Matsumoto's avatar
      Refactor `mruby-catch`; ref #5328 · c7809ca0
      Yukihiro "Matz" Matsumoto authored
      - Move `#catch` definition to `mruby-catch.c` to avoid tweaking
      - Remove `#__preserve_catch_method`
      - Implement whole `#throw` method in C
      c7809ca0
    • KOBAYASHI Shuji's avatar
      Fix heap-buffer-overflow for small `Hash` (HT) in `Hash#rehash` · 28eb6271
      KOBAYASHI Shuji authored
      ### Example
      
      ##### example.rb
      
      ```ruby
      h = {}
      (1..17).each{h[_1] = _1}
      (1..16).each{h.delete(_1)}
      h.rehash
      ```
      
      ##### ASAN report
      
      ```console
      $ bin/mruby example.rb
      ==52587==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000006998 at pc 0x55a29cddf96b bp 0x7fff7b1b1720 sp 0x7fff7b1b1710
      READ of size 4 at 0x602000006998 thread T0
          #0 0x55a29cddf96a in ib_it_next /mruby/src/hash.c:639
          #1 0x55a29cde2ca2 in ht_rehash /mruby/src/hash.c:900
          #2 0x55a29cde379f in h_rehash /mruby/src/hash.c:996
          #3 0x55a29cde7f3d in mrb_hash_rehash /mruby/src/hash.c:1735
          #4 0x55a29ce77b62 in mrb_vm_exec /mruby/src/vm.c:1451
          #5 0x55a29ce5fa88 in mrb_vm_run /mruby/src/vm.c:981
          #6 0x55a29ceb87e1 in mrb_top_run /mruby/src/vm.c:2874
          #7 0x55a29cf36bdf in mrb_load_exec mrbgems/mruby-compiler/core/parse.y:6805
          #8 0x55a29cf36f25 in mrb_load_detect_file_cxt mrbgems/mruby-compiler/core/parse.y:6848
          #9 0x55a29cdba0a2 in main /mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:347
          #10 0x7f24ef43b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
          #11 0x55a29cdb4a6d in _start (/mruby/bin/mruby+0x2a3a6d)
      
      0x602000006998 is located 0 bytes to the right of 8-byte region [0x602000006990,0x602000006998)
      allocated by thread T0 here:
          #0 0x7f24f01cfffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
          #1 0x55a29ceb9440 in mrb_default_allocf /mruby/src/state.c:68
          #2 0x55a29cdba747 in mrb_realloc_simple /mruby/src/gc.c:228
          #3 0x55a29cdba928 in mrb_realloc /mruby/src/gc.c:242
          #4 0x55a29cde12e5 in ht_init /mruby/src/hash.c:749
          #5 0x55a29cde2b8e in ht_rehash /mruby/src/hash.c:897
          #6 0x55a29cde379f in h_rehash /mruby/src/hash.c:996
          #7 0x55a29cde7f3d in mrb_hash_rehash /mruby/src/hash.c:1735
          #8 0x55a29ce77b62 in mrb_vm_exec /mruby/src/vm.c:1451
          #9 0x55a29ce5fa88 in mrb_vm_run /mruby/src/vm.c:981
          #10 0x55a29ceb87e1 in mrb_top_run /mruby/src/vm.c:2874
          #11 0x55a29cf36bdf in mrb_load_exec mrbgems/mruby-compiler/core/parse.y:6805
          #12 0x55a29cf36f25 in mrb_load_detect_file_cxt mrbgems/mruby-compiler/core/parse.y:6848
          #13 0x55a29cdba0a2 in main /mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:347
          #14 0x7f24ef43b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
      ```
      28eb6271
    • Yukihiro "Matz" Matsumoto's avatar
  4. 09 Feb, 2021 1 commit
  5. 08 Feb, 2021 2 commits
  6. 07 Feb, 2021 6 commits
  7. 06 Feb, 2021 2 commits
    • dearblue's avatar
      Reimplement mruby-catch; ref #5321 · 232e07ad
      dearblue authored
      When there is a corresponding tag, the `RBreak` object is used to make a global jump.
      
      Like CRuby, it can't be caught by `rescue`.
      It is also the same as CRuby that it can be canceled in the middle by `ensure`.
      
       ### How to find the corresponding tag with `throw`
      
      The called `catch` method remains in the call stack, and the tag also remains in the stack at that time.
      So it is possible to find the called location by searching the two.
      
      Note that no method can be given to the `proc` object specified in `RBreak`.
      Therefore, inside the `catch` method, the argument block is called in a seemingly meaningless closure.
      
      Also, as a countermeasure against `alias` etc., the `proc` object, which is the body of the `catch` method, is saved when mrbgem is initialized.
      232e07ad
    • Yukihiro "Matz" Matsumoto's avatar
      MinGW does not need MSVC hack. · ef8f4757
      Yukihiro "Matz" Matsumoto authored
      Both MinGW and MSVC provide _WIN32 macro.
      ef8f4757