From: petr.hluzin@... Date: 2018-02-05T22:25:34+00:00 Subject: [ruby-core:85420] [Ruby trunk Bug#14453] Ruby crashes in w32_cmdvector() if Application Verifier is enabled Issue #14453 has been reported by PetrH (Petr Hluzin). ---------------------------------------- Bug #14453: Ruby crashes in w32_cmdvector() if Application Verifier is enabled https://bugs.ruby-lang.org/issues/14453 * Author: PetrH (Petr Hluzin) * Status: Open * Priority: Normal * Assignee: * Target version: * ruby -v: ruby 2.4.1p111 (2017-03-22) [i386-mswin32_140] * Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN ---------------------------------------- On Windows, Application Verifier (AV) is a tool by Microsoft that detects common bugs in applications. When AV detects a bug, it usually crashes the process, depending on a kind of the bug. Steps to reproduce: 1. Enable verification of heap-related calls in Application Verifier 2. Launch ruby.exe with no parameters. The crash occurs before any script is loaded. Result: Process ruby.exe crashes with following functions on call-stack: 00 vcruntime140_ruby240!strlcpy 01 vcruntime140_ruby240!w32_cmdvector 02 vcruntime140_ruby240!rb_w32_sysinit 03 vcruntime140_ruby240!ruby_sysinit 04 ruby!main 05 ruby!invoke_main 06 ruby!__scrt_common_main_seh 07 kernel32!BaseThreadInitThunk 08 ntdll!__RtlUserThreadStart 09 ntdll!_RtlUserThreadStart Expected result: The process should not crash and show REPL prompt or something. The Application Verifier is a GUI tool. Instead you can use gflags.exe tool that comes with a Debugging Tools for Windows and invoke "gflags.exe /p /enable ruby.exe /full". "Full page heap" is needed (the default debugging mode) for the crash to occur. The crash occurs because line in function w32_cmdvector() in src\win32\win32.c curr->str = rb_w32_wstr_to_mbstr(cp, base, len, &curr->len); allocates space and does _not_ terminate string `curr->str'. When later function w32_cmdvector() executes line strlcpy(cptr, curr->str, curr->len + 1); the implementation of function strlcpy() in src\missing\strlcpy.c copies the needed bytes and then traverses following characters until terminating NUL byte (here missing), apparently in hope of detecting an unterminated string. When heap verification in Application Verifier is enabled, then a non-accessible page is placed after each allocation, similar to how famous Electric Fence works. The strlcpy() runs into the non-accessible page and triggers access violation. Suggested fix (three line): char * rb_w32_wstr_to_mbstr(UINT cp, const WCHAR *wstr, int clen, long *plen) { char *ptr; int len = WideCharToMultiByte(cp, 0, wstr, clen, NULL, 0, NULL, NULL); - if (!(ptr = malloc(len))) return 0; + if (!(ptr = malloc((clen == -1) ? len : (len + 1)))) return 0; WideCharToMultiByte(cp, 0, wstr, clen, ptr, len, NULL, NULL); if (plen) { /* exclude NUL only if NUL-terminated string */ if (clen == -1) --len; *plen = len; } + if (clen != -1) + ptr[len] = '\0'; return ptr; } This fix also has the minor advantage that this line in w32_cmdvector() strlcpy(cptr, curr->str, curr->len + 1); can be changed to a simple strcpy(). Or the strlcpy() call can be changed in a way the third parameter will be the remaining capacity of buffer, as it is the purpose of strlcpy(). -- https://bugs.ruby-lang.org/ Unsubscribe: