From: Tanaka Akira <akr@...17n.org>
Date: 2004-10-02T01:40:59+09:00
Subject: [ruby-dev:24382] instance_eval dumps core

次のようにすると core を吐きます。

% ./ruby -e '
file = "\0" * 0x20000
file[0,3] = "aaa"
line = Object.new
class << line; self end.send(:define_method, :to_int) {
  file.replace ""
  10
}
0.instance_eval("p __FILE__", file, line)
'
-e:9: [BUG] Segmentation fault
ruby 1.9.0 (2004-10-02) [i686-linux]

zsh: abort (core dumped)  ./ruby -e 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -e 
file = "\0" * 0x20000
file[0,3] = "aaa"
line = Object.new
class << l'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e721 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e721 in kill () from /lib/libc.so.6
#1  0x4009e4c5 in raise () from /lib/libc.so.6
#2  0x4009f9e8 in abort () from /lib/libc.so.6
#3  0x080d2046 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b0012 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  strhash (string=0x401d9008 <Address 0x401d9008 out of bounds>) at st.c:563
#7  0x080b2837 in st_lookup (table=0x8138aa8, key=1075679240, value=0xbfffeb08) at st.c:258
#8  0x0806f96a in rb_source_filename (f=0x401d9008 <Address 0x401d9008 out of bounds>) at gc.c:520
#9  0x08092f8d in yycompile (parser=0x813a0b8, f=0x401d9008 <Address 0x401d9008 out of bounds>, line=0) at parse.y:4329
#10 0x08093234 in rb_compile_string (f=0x8138aa8 "\217\017\b\v", s=135498408, line=10) at parse.y:4401
#11 0x0805ee14 in compile (src=1075607556, file=0x80f8fc8 "0/\005\b /\v\b", line=135237576) at eval.c:6005
#12 0x0805f312 in eval (self=1, src=1075607556, scope=4, file=0x401d9008 <Address 0x401d9008 out of bounds>, line=10)
    at eval.c:6086
#13 0x0805f811 in eval_under_i (args=0x8138aa8) at eval.c:6254
#14 0x0805f789 in exec_under (func=0x805f7e0 <eval_under_i>, under=135237576, cbase=4, args=0xbfffee50) at eval.c:6238
#15 0x0805f873 in eval_under (under=4, self=135237576, src=1075607556, file=0x80f8fc8 "0/\005\b /\v\b", line=135237576)
    at eval.c:6276
#16 0x0805f9c6 in specific_eval (argc=3, argv=0xbffff108, klass=4, self=1) at eval.c:6330
#17 0x0805faba in rb_obj_instance_eval (argc=135237576, argv=0x80f8fc8, self=1) at eval.c:6371
#18 0x08069f7a in call_cfunc (func=0x805fa80 <rb_obj_instance_eval>, recv=1, len=135498408, argc=1075679240, 
    argv=0xbffff108) at eval.c:5368
#19 0x0805e187 in rb_call0 (klass=1075678376, recv=1, id=4081, oid=135237576, argc=3, argv=0xbffff108, body=0x401d6ca0, 
    nosuper=0) at eval.c:5509
#20 0x0805e438 in rb_call (klass=1075678376, recv=1, mid=4081, argc=3, argv=0xbffff108, scope=0) at eval.c:5730
#21 0x08059368 in rb_eval (self=1075673496, n=0x80f8fc8) at ruby.h:635
#22 0x080558fb in ruby_exec () at eval.c:1458
#23 0x08055940 in ruby_run () at eval.c:1484
#24 0x08053a05 in main (argc=135237576, argv=0x80f8fc8, envp=0xbffff8e4) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]