[ruby-core:17379] Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix)

From: "M. Edward (Ed) Borasky" <[e-mail]>
> Bill Kelly wrote:
>
>> Updated to latest subversion ruby_1_8_6 branch, revision 17546.
>> (patchlevel 231)
>> 
>> However, still getting a seg fault on:
>> 
>> ruby -ve 'str = "A"*(2**16) ; loop{ str << str ; puts str.size }'
>> ruby 1.8.6 (2008-06-22 patchlevel 231) [i686-linux]
>> 131072
>> 262144
>> -e:1: [BUG] Segmentation fault
> 
> Can you run this with "gdb?"

I'm a gdb newbie, but it's high time I learned.

Here's a backtrace:

(gdb) bt
#0  0x4bc3583b in raise () from /lib/tls/libc.so.6
#1  0x4bc36fa2 in abort () from /lib/tls/libc.so.6
#2  0x4bdb9a61 in rb_bug (fmt=0x0) at error.c:214
#3  0x4be231d2 in sigsegv (sig=11) at signal.c:628
#4  <signal handler called>
#5  0x4bc8707f in memcpy () from /lib/tls/libc.so.6
#6  0x4be277e1 in str_buf_cat (str=1267367944, ptr=0x20000 <Address 0x20000 out of bounds>, len=131072) at string.c:720
#7  0x4be27a08 in rb_str_buf_append (str=1270813180, str2=1270813180) at string.c:781
#8  0x4be27aac in rb_str_append (str=1270813180, str2=1270813180) at string.c:802
#9  0x4be27b76 in rb_str_concat (str1=32768, str2=131072) at string.c:837
#10 0x4bdd594b in call_cfunc (func=0x4be27b40 <rb_str_concat>, recv=1270813180, len=131072, argc=32768, argv=0x5b07580c)
    at eval.c:5700
#11 0x4bdc7970 in rb_call0 (klass=1270913000, recv=1270813180, id=334, oid=131072, argc=1, argv=0x5b07580c, body=0x4bc09040,
    flags=0) at eval.c:5859
#12 0x4bdc84d6 in rb_call (klass=1270913000, recv=1270813180, mid=334, argc=1, argv=0x5b07580c, scope=0, self=1270917540)
    at eval.c:6106
#13 0x4bdc27e7 in rb_eval (self=1270917540, n=0x20000) at ruby.h:679
#14 0x4bdc5a28 in rb_yield_0 (val=6, self=1270917540, klass=0, flags=0, avalue=0) at eval.c:5033
#15 0x4bdc61d4 in rb_f_loop () at eval.c:5179
#16 0x4bdd596e in call_cfunc (func=0x4bdc6190 <rb_f_loop>, recv=1270917540, len=131072, argc=32768, argv=0x0) at eval.c:5706
#17 0x4bdc7970 in rb_call0 (klass=1270922400, recv=1270917540, id=3953, oid=131072, argc=0, argv=0x0, body=0x4bc0a0e4, flags=2)
    at eval.c:5859
#18 0x4bdc84d6 in rb_call (klass=1270922400, recv=1270917540, mid=3953, argc=0, argv=0x0, scope=1, self=1270917540) at eval.c:6106
#19 0x4bdc27e7 in rb_eval (self=1270917540, n=0x20000) at ruby.h:679
#20 0x4bdc1b56 in rb_eval (self=1270917540, n=0x20000) at eval.c:3215
#21 0x4bdbe6fc in ruby_exec_internal () at eval.c:1641
#22 0x4bdbe754 in ruby_exec () at eval.c:1661
#23 0x4bdbe791 in ruby_run () at eval.c:1671
#24 0x0804872e in main (argc=131072, argv=0x20000, envp=0x5b077134) at main.c:48

..apparently rb_str_buf_append doesn't like appending the same
string to itself? (?)

If more info would be useful, please let me know.


Regards,

Bill