diff options
author | ko1 <ko1@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-09-26 16:51:09 +0000 |
---|---|---|
committer | ko1 <ko1@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-09-26 16:51:09 +0000 |
commit | e0b3e5e12fae0527cbdb5af41a851c4cffe84711 (patch) | |
tree | 8063d6ffd4c2401fd70f571f321a6155bd4848dc | |
parent | 22de2030c501413732a9da9aa1f424a7bf607076 (diff) | |
download | ruby-e0b3e5e12fae0527cbdb5af41a851c4cffe84711.tar.gz |
fix use-after-free in obj_free.
* gc.c (obj_free): a table can be accessed for debug counters.
[Bug #15165] [Fix GH-1964]
A patch from Joe Truba <jtruba@meraki.com>
Also check USE_DEBUG_COUNTER macro.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@64857 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r-- | gc.c | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -2261,8 +2261,7 @@ obj_free(rb_objspace_t *objspace, VALUE obj) break; case T_HASH: if (RANY(obj)->as.hash.ntbl) { - st_free_table(RANY(obj)->as.hash.ntbl); - +#if USE_DEBUG_COUNTER if (RHASH_SIZE(obj) >= 8) { RB_DEBUG_COUNTER_INC(obj_hash_ge8); } @@ -2272,6 +2271,8 @@ obj_free(rb_objspace_t *objspace, VALUE obj) else { RB_DEBUG_COUNTER_INC(obj_hash_under4); } +#endif + st_free_table(RANY(obj)->as.hash.ntbl); } else { RB_DEBUG_COUNTER_INC(obj_hash_empty); |