aboutsummaryrefslogtreecommitdiffstats
path: root/eval.c
diff options
context:
space:
mode:
authorPeter Zhu <peter@peterzhu.ca>2023-04-12 11:40:34 -0400
committerPeter Zhu <peter@peterzhu.ca>2023-04-13 08:38:35 -0400
commit02a7e12b80823919fb614ad3ea6241d5115d14fe (patch)
treeed0bc2ccc0c233b66bd42694929cc0aa0d73bbb9 /eval.c
parent64e503eb62aff0952b655e9a86217e355f786146 (diff)
downloadruby-02a7e12b80823919fb614ad3ea6241d5115d14fe.tar.gz
Ensure throw data is not set as cause
[Bug #19593] rb_ec_setup_exception did not check if errinfo is a throw_data. This can cause crashes in code since it is assumed that id_cause is an object. We saw a crash in show_cause due to id_cause of errinfo being a throw_data. It crashes on rb_obj_is_kind_of since it cannot be called on T_IMEMO objects. Unfortunately, we couldn't find a reproduction script, however we debugged the core dump and rb_ec_setup_exception is the only place where id_cause is assigned from errinfo without checking if it is a throw_data. ``` 0x0000556c5708e6dd in sigsegv (sig=11, info=0x7f301befa3f0, ctx=0x7f301befa2c0) at signal.c:964 0x00007f301d046420 in <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0 class_search_class_ancestor (c=139844586301760, cl=<optimized out>) at object.c:810 rb_obj_is_kind_of (obj=obj@entry=139839221734880, c=139844586301760) at object.c:861 0x0000556c56f2f00f in show_cause (errinfo=errinfo@entry=139838840645160, str=str@entry=139839221730520, opt=139839221730480, highlight=0, reverse=reverse@entry=0, backtrace_limit=backtrace_limit@entry=-1, shown_causes=0x7ffe9d1a2d68) at ./include/ruby/internal/special_consts.h:175 ``` Co-Authored-By: Jean Boussier <byroot@ruby-lang.org>
Diffstat (limited to 'eval.c')
-rw-r--r--eval.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/eval.c b/eval.c
index adacde9e2f..6fc3969690 100644
--- a/eval.c
+++ b/eval.c
@@ -645,6 +645,10 @@ rb_ec_setup_exception(const rb_execution_context_t *ec, VALUE mesg, VALUE cause)
cause = get_ec_errinfo(ec);
}
if (cause != mesg) {
+ if (THROW_DATA_P(cause)) {
+ cause = Qnil;
+ }
+
rb_ivar_set(mesg, id_cause, cause);
}
}