[ruby-dev:11745] Re: cgi.rb で InsecureOperation

さらに調べた結果、現象と解決方法がわかったので、
報告します。

module_setup()の中で、alloca()した領域を、
parse.yのtop_local_setup()の中でrealloc()してしまう
ためにfaultしています。
Tempfile.new()の中で間接的にlambdaが呼び出されているので、
ruby_scope->flagにSCOPE_DONT_RECYCLE(=4)が立って、それが
祖先のruby_scopeに継承されて、その後top_local_setup()に
入ったときにmalloc()すべきところをrealloc()するような判定
をしていることが原因です。

top_local_setup()の
if (i == 0 || ruby_scope->flag == SCOPE_ALLOCA) {
を、
if (i == 0 || (ruby_scope->flag & SCOPE_MALLOC) == 0) {
に変更すれば、faultしなくなりました。

CVSのスナップショット版については、
以下の変更が入っているので、同じ現象は起きないようです。
(scope_dup()の中でlocal_varsをmalloc()しているから。)

Sun Oct  8 13:20:26 2000  Guy Decoux  <[e-mail]>

	* eval.c (POP_SCOPE): not just set SCOPE_DONT_RECYCLE, but do
	  scope_dup().

現象
[kosako@tao ruby-1.6.1]$ cat test.rb
require "tempfile"

module FOO
  body = Tempfile.new("CGI")
  eval <<-END
   def bar
     #{a=1}
   end
  END
end
[kosako@tao ruby-1.6.1]$ ./ruby -v
ruby 1.6.1 (2000-09-27) [i586-linux]
[kosako@tao ruby-1.6.1]$ gdb ./ruby
GNU gdb 4.17.0.4 with Linux/x86 hardware watchpoint and FPU support
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(gdb) break top_local_setup
Breakpoint 1 at 0x80836d5: file parse.y, line 4600.
(gdb) condition 1 ruby_scope->flag == 4
(gdb) run test.rb
Starting program: /home/kosako/z/ruby-1.6.1/./ruby test.rb

Breakpoint 1, top_local_setup () at parse.y:4600
4600	    int len = lvtbl->cnt;
(gdb) print *ruby_scope
$1 = {super = {flags = 62, klass = 0}, local_tbl = 0x80f3e38, 
  local_vars = 0xbfffef34, flag = 4}
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x4009ed01 in __libc_realloc (oldmem=0xbfffef30, bytes=20) at malloc.c:3080
(gdb) where
#0  0x4009ed01 in __libc_realloc (oldmem=0xbfffef30, bytes=20) at malloc.c:3080
#1  0x8062df2 in ruby_xrealloc (ptr=0xbfffef30, size=20) at gc.c:117
#2  0x8083793 in top_local_setup () at parse.y:4623
#3  0x8077693 in rb_yyparse () at parse.y:272
#4  0x8079a1f in yycompile (f=0x80f3c80 "test.rb", line=6) at parse.y:1922
#5  0x8079b80 in rb_compile_string (f=0x80f3c80 "test.rb", s=1074953208, 
    line=6) at parse.y:1982
#6  0x8058e91 in compile (src=1074953208, file=0x80f3c80 "test.rb", line=6)
    at eval.c:4570
#7  0x8055323 in rb_eval (self=1074930848, n=0x40127bbc) at eval.c:2753
#8  0x80543f3 in rb_eval (self=1074930848, n=0x40127ab8) at eval.c:2410
#9  0x805618f in module_setup (module=1074930848, n=0x40127d38) at eval.c:3133
#10 0x8055ebc in rb_eval (self=1075006688, n=0x40127a40) at eval.c:3054
#11 0x805138f in eval_node (self=1075006688, node=0x40127a40) at eval.c:1032
#12 0x80515c7 in ruby_run () at eval.c:1125
#13 0x80501dc in main (argc=2, argv=0xbffff6dc, envp=0xbffff6e8) at main.c:45
(gdb) quit
The program is running.  Exit anyway? (y or n)


修正案です。
diff -u -w parse.y ~/z/ruby-1.6.1/parse.y
--- parse.y	Sat Sep 23 03:15:44 2000
+++ /home/kosako/z/ruby-1.6.1/parse.y	Tue Dec 12 14:31:32 2000
@@ -4604,7 +4604,7 @@
 	i = ruby_scope->local_tbl?ruby_scope->local_tbl[0]:0;
 
 	if (i < len) {
-	    if (i == 0 || ruby_scope->flag == SCOPE_ALLOCA) {
+	    if (i == 0 || (ruby_scope->flag & SCOPE_MALLOC) == 0) {
 		VALUE *vars = ALLOC_N(VALUE, len+1);
 		if (ruby_scope->local_vars) {
 		    *vars++ = ruby_scope->local_vars[-1];
---
小迫＠ソフネック        渋谷区恵比寿1-15-1