Validate the typed data before dereferencing the internal struct. (#8315)

2 files changed, 24 insertions, 2 deletions

diff --git a/process.c b/process.c
index 0de0b1f0a3..5468cf0846 100644
--- a/process.c
+++ b/process.c
@@ -1222,7 +1222,7 @@ rb_waitpid(rb_pid_t pid, int *st, int flags)
     VALUE status = rb_process_status_wait(pid, flags);
     if (NIL_P(status)) return 0;
 
-    struct rb_process_status *data = RTYPEDDATA_DATA(status);
+    struct rb_process_status *data = rb_check_typeddata(status, &rb_process_status_type);
     pid = data->pid;
 
     if (st) *st = data->status;
@@ -4748,7 +4748,8 @@ rb_f_system(int argc, VALUE *argv, VALUE _)
 
     if (pid > 0) {
         VALUE status = rb_process_status_wait(pid, 0);
-        struct rb_process_status *data = RTYPEDDATA_DATA(status);
+
+        struct rb_process_status *data = rb_check_typeddata(status, &rb_process_status_type);
 
         // Set the last status:
         rb_obj_freeze(status);
diff --git a/test/fiber/test_process.rb b/test/fiber/test_process.rb
index a5990be204..cc1694576e 100644
--- a/test/fiber/test_process.rb
+++ b/test/fiber/test_process.rb
@@ -34,6 +34,27 @@ class TestFiberProcess < Test::Unit::TestCase
     end.join
   end
 
+  def test_system_faulty_process_wait
+    Thread.new do
+      scheduler = Scheduler.new
+
+      def scheduler.process_wait(pid, flags)
+        Fiber.blocking{Process.wait(pid, flags)}
+
+        # Don't return `Process::Status` instance.
+        return false
+      end
+
+      Fiber.set_scheduler scheduler
+
+      Fiber.schedule do
+        assert_raise TypeError do
+          system("true")
+        end
+      end
+    end.join
+  end
+
   def test_fork
     omit 'fork not supported' unless Process.respond_to?(:fork)
     Thread.new do