HexBrain

shopify-scripts · Report #219870

mirb only: stack-buffer-overflow (OOB write) in main()

Validstatus
highseverity
3upvotes
9 May 2017disclosed

How it was found

Triggered in 7e28510 (7 April 2017) with mirb only.

cat test013.rb | mirb

==17976==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffeb477fb0 at pc 0x408c21 bp 0x7fffeb477a90 sp 0x7fffeb477a88
WRITE of size 1 at 0x7fffeb477fb0 thread T0
    #0 0x408c20 in main /root/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:466
    #1 0x7f96e4703b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
    #2 0x40aefc (/root/mruby/bin/mirb+0x40aefc)

Address 0x7fffeb477fb0 is located in stack of thread T0 at offset 1184 in frame
    #0 0x40549f in main /root/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:361

  This frame has 4 object(s):
    [32, 56) 'args'
    [96, 126) 'unexpected_end'
    [160, 1184) 'last_code_line' <== Memory access at offset 1184 overflows this variable
    [1216, 5312) 'ruby_code'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /root/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:466 main

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original