[ruby-core:17459] Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix)

From: "Bill Kelly" <[e-mail]>
> 
> Updated to latest subversion ruby_1_8_6 branch, revision 17546.
> (patchlevel 231)
> 
> However, still getting a seg fault on:
> 
> ruby -ve 'str = "A"*(2**16) ; loop{ str << str ; puts str.size }'
> ruby 1.8.6 (2008-06-22 patchlevel 231) [i686-linux]
> 131072
> 262144
> -e:1: [BUG] Segmentation fault

Note, still getting this seg fault as of svn revision 17730
on 1_8_6 branch:

$ ruby -ve 'str = "A"*(2**16) ; loop{ str << str ; puts str.size }'
ruby 1.8.6 (2008-06-29 patchlevel 255) [i686-linux]
131072
-e:1: [BUG] Segmentation fault


(gdb) bt
#0  0x530a083b in raise () from /lib/tls/libc.so.6
#1  0x530a1fa2 in abort () from /lib/tls/libc.so.6
#2  0x53224a71 in rb_bug (fmt=0x0) at error.c:214
#3  0x5328e132 in sigsegv (sig=11) at signal.c:629
#4  <signal handler called>
#5  0x530f207f in memcpy () from /lib/tls/libc.so.6
#6  0x53292741 in str_buf_cat (str=1389441032, ptr=0x20000 <Address 0x20000 out of bounds>, len=131072) at string.c:720
#7  0x53292968 in rb_str_buf_append (str=1392884200, str2=1392884200) at string.c:781
#8  0x53292a0c in rb_str_append (str=1392884200, str2=1392884200) at string.c:802
#9  0x53292ad6 in rb_str_concat (str1=32768, str2=131072) at string.c:837
#10 0x5324090b in call_cfunc (func=0x53292aa0 <rb_str_concat>, recv=1392884200, len=131072, argc=32768, argv=0x5f0bec4c)
    at eval.c:5706
#11 0x53232930 in rb_call0 (klass=1392986080, recv=1392884200, id=334, oid=131072, argc=1, argv=0x5f0bec4c, body=0x53074038,
    flags=0) at eval.c:5864
#12 0x53233496 in rb_call (klass=1392986080, recv=1392884200, mid=334, argc=1, argv=0x5f0bec4c, scope=0, self=1392990620)
    at eval.c:6111
#13 0x5322d7e7 in rb_eval (self=1392990620, n=0x20000) at ruby.h:679
#14 0x532309f5 in rb_yield_0 (val=6, self=1392990620, klass=0, flags=0, avalue=0) at eval.c:5039
#15 0x532311a4 in rb_f_loop () at eval.c:5185
#16 0x5324092e in call_cfunc (func=0x53231160 <rb_f_loop>, recv=1392990620, len=131072, argc=32768, argv=0x0) at eval.c:5712
#17 0x53232930 in rb_call0 (klass=1392995480, recv=1392990620, id=3953, oid=131072, argc=0, argv=0x0, body=0x530750dc, flags=2)
    at eval.c:5864
#18 0x53233496 in rb_call (klass=1392995480, recv=1392990620, mid=3953, argc=0, argv=0x0, scope=1, self=1392990620) at eval.c:6111
#19 0x5322d7e7 in rb_eval (self=1392990620, n=0x20000) at ruby.h:679
#20 0x5322cb56 in rb_eval (self=1392990620, n=0x20000) at eval.c:3220
#21 0x532296fc in ruby_exec_internal () at eval.c:1643
#22 0x53229754 in ruby_exec () at eval.c:1663
#23 0x53229791 in ruby_run () at eval.c:1673
#24 0x0804872e in main (argc=131072, argv=0x20000, envp=0x5f0c0564) at main.c:48



Regards,

Bill