[ruby-core:58611] [ruby-trunk - Bug #9157] rb_readlink() calls rb_str_modify_expand() too early

Issue #9157 has been updated by nowacki (Maciek Nowacki).


nobu (Nobuyoshi Nakada) wrote:
> This issue was solved with changeset r43853.
Ah, I didn't realize that rb_str_modify_expand() takes a difference as its argument, not the total buffer length. This works because the function doubles the buffer size, which is the same as adding as much buffer capacity as is already present (size before *=2). My proposed fix simply made the problem less obvious. Interesting.

> Maciek, thank you for reporting this issue.
> Your contribution to Ruby is greatly appreciated.
> May Ruby be with you.
> 
> 
> ----------
> file.c: fix buffer overflow
> 
> * file.c (rb_readlink): fix buffer overflow on a long symlink. since
>   rb_str_modify_expand() expands from its length but not its capacity,
>   need to set the length properly for each expansion.
>   [ruby-core:58592] [Bug #9157]


----------------------------------------
Bug #9157: rb_readlink() calls rb_str_modify_expand() too early
https://bugs.ruby-lang.org/issues/9157#change-43179

Author: nowacki (Maciek Nowacki)
Status: Closed
Priority: Normal
Assignee: 
Category: core
Target version: current: 2.1.0
ruby -v: ruby 2.0.0p353 (2013-11-22) [x86_64-linux]
Backport: 1.9.3: DONTNEED, 2.0.0: REQUIRED


If rb_readlink() (file.c) is called on a long symlink, Ruby tends to crash. This is present in -trunk. The problem is that the rb_str_modify_expand() statement is incorrectly placed before the statement 'size*=2'. Here is a patch:

--- -	2013-11-25 22:10:59.694183795 -0700
+++ file.c	2013-11-25 22:10:03.076352889 -0700
@@ -2529,8 +2529,8 @@
	    || (rv < 0 && errno == ERANGE) /* quirky behavior of GPFS */
#endif
	) {
-	rb_str_modify_expand(v, size);
	size *= 2;
+	rb_str_modify_expand(v, size);
   }
   if (rv < 0) {
	rb_str_resize(v, 0);


-- 
http://bugs.ruby-lang.org/