From: normalperson@...
Date: 2014-09-26T07:42:09+00:00
Subject: [ruby-core:65282] [ruby-trunk - Bug #10296] SEGV from unchecked Data_Get_Struct() argument

Issue #10296 has been updated by Eric Wong.


 Calling initialize_copy directly is probably buggy behavior and not
 unique to just the json/zlib C extensions.
 
 Other than telling users to never call initialize_copy directly, I'm not
 sure what to do about it.  It would be a lot of effort to fix every
 existing extension out there.
 
 Moving towards rb_data_type_t should allow CRuby to enforce this
 transparently.
 
 Maybe other folks have better ideas...

----------------------------------------
Bug #10296: SEGV from unchecked Data_Get_Struct() argument
https://bugs.ruby-lang.org/issues/10296#change-49104

* Author: Josh Haberman
* Status: Open
* Priority: Normal
* Assignee: 
* Category: 
* Target version: 
* ruby -v: ruby 2.1.3p242 (2014-09-19 revision 47630) [x86_64-darwin13.0]
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN
----------------------------------------
I can crash all Ruby versions I tried with this program:

require 'json'
require 'zlib'
 
module JSON
  module Ext
    module Generator
      class State
        def foo
          initialize_copy(Zlib::GzipWriter.new('foo.gz'))
        end
      end
    end
  end
end
 
state = JSON::Ext::Generator::State.new.foo



-- 
https://bugs.ruby-lang.org/