Forum: Ruby-core [ruby-trunk - Bug #7957][Open] rb_str_modify() does not prevent shared string from rb_str_set_len()

Issue #7957 has been reported by normalperson (Eric Wong).

----------------------------------------
Bug #7957: rb_str_modify() does not prevent shared string from 
rb_str_set_len()
https://bugs.ruby-lang.org/issues/7957

Author: normalperson (Eric Wong)
Status: Open
Priority: Normal
Assignee:
Category:
Target version:
ruby -v: ruby 2.0.0p0 (2013-02-24 revision 39474) [x86_64-linux]


unicorn HTTP chunk parser may raise "can't set length of shared string 
(RuntimeError)" in rb_str_set_len().
However, it does call rb_str_modify() before calling rb_str_set_len().

To reproduce:
git clone git://bogomips.org/unicorn
cd unicorn
gem install isolate # needed for unicorn dependencies
git reset --hard v4.6.1
make http # build HTTP parser (needs ragel installed: apt-get install 
ragel)
ruby -I lib str_modify.rb # failure, raises

# apply unicorn_http.patch
patch -p1 < unicorn_http.patch
make http # rebuild parser
ruby -I lib str_modify.rb # success (no output)

In my proposed patch, I call rb_str_resize() instead of rb_str_set_len() 
and that seems to
work around the issue.  I even call rb_str_modify() an extra time before 
rb_str_set_len(),
but rb_str_set_len() still raises...

Issue #7957 has been updated by ko1 (Koichi Sasada).

Category set to core
Assignee set to nobu (Nobuyoshi Nakada)
Priority changed from Normal to High
Target version set to 2.1.0


----------------------------------------
Bug #7957: rb_str_modify() does not prevent shared string from 
rb_str_set_len()
https://bugs.ruby-lang.org/issues/7957#change-37009

Author: normalperson (Eric Wong)
Status: Open
Priority: High
Assignee: nobu (Nobuyoshi Nakada)
Category: core
Target version: 2.1.0
ruby -v: ruby 2.0.0p0 (2013-02-24 revision 39474) [x86_64-linux]


unicorn HTTP chunk parser may raise "can't set length of shared string 
(RuntimeError)" in rb_str_set_len().
However, it does call rb_str_modify() before calling rb_str_set_len().

To reproduce:
git clone git://bogomips.org/unicorn
cd unicorn
gem install isolate # needed for unicorn dependencies
git reset --hard v4.6.1
make http # build HTTP parser (needs ragel installed: apt-get install 
ragel)
ruby -I lib str_modify.rb # failure, raises

# apply unicorn_http.patch
patch -p1 < unicorn_http.patch
make http # rebuild parser
ruby -I lib str_modify.rb # success (no output)

In my proposed patch, I call rb_str_resize() instead of rb_str_set_len() 
and that seems to
work around the issue.  I even call rb_str_modify() an extra time before 
rb_str_set_len(),
but rb_str_set_len() still raises...

I will try to make a standalone test case which does not depend on
the Ragel parser.

Issue #7957 has been updated by normalperson (Eric Wong).


sorry for the noise.  It turns out unicorn has a build system bug.
----------------------------------------
Bug #7957: rb_str_modify() does not prevent shared string from 
rb_str_set_len()
https://bugs.ruby-lang.org/issues/7957#change-37078

Author: normalperson (Eric Wong)
Status: Open
Priority: High
Assignee: nobu (Nobuyoshi Nakada)
Category: core
Target version: current: 2.1.0
ruby -v: ruby 2.0.0p0 (2013-02-24 revision 39474) [x86_64-linux]


unicorn HTTP chunk parser may raise "can't set length of shared string 
(RuntimeError)" in rb_str_set_len().
However, it does call rb_str_modify() before calling rb_str_set_len().

To reproduce:
git clone git://bogomips.org/unicorn
cd unicorn
gem install isolate # needed for unicorn dependencies
git reset --hard v4.6.1
make http # build HTTP parser (needs ragel installed: apt-get install 
ragel)
ruby -I lib str_modify.rb # failure, raises

# apply unicorn_http.patch
patch -p1 < unicorn_http.patch
make http # rebuild parser
ruby -I lib str_modify.rb # success (no output)

In my proposed patch, I call rb_str_resize() instead of rb_str_set_len() 
and that seems to
work around the issue.  I even call rb_str_modify() an extra time before 
rb_str_set_len(),
but rb_str_set_len() still raises...

This is definitely not a ruby bug, fixed in unicorn v4.6.2
(commit f7ee06592d7709e96f64efb5e7a9485b54415c9d)

Issue #7957 has been updated by usa (Usaku NAKAMURA).

Status changed from Open to Third Party's Issue


----------------------------------------
Bug #7957: rb_str_modify() does not prevent shared string from 
rb_str_set_len()
https://bugs.ruby-lang.org/issues/7957#change-37079

Author: normalperson (Eric Wong)
Status: Third Party's Issue
Priority: High
Assignee: nobu (Nobuyoshi Nakada)
Category: core
Target version: current: 2.1.0
ruby -v: ruby 2.0.0p0 (2013-02-24 revision 39474) [x86_64-linux]


unicorn HTTP chunk parser may raise "can't set length of shared string 
(RuntimeError)" in rb_str_set_len().
However, it does call rb_str_modify() before calling rb_str_set_len().

To reproduce:
git clone git://bogomips.org/unicorn
cd unicorn
gem install isolate # needed for unicorn dependencies
git reset --hard v4.6.1
make http # build HTTP parser (needs ragel installed: apt-get install 
ragel)
ruby -I lib str_modify.rb # failure, raises

# apply unicorn_http.patch
patch -p1 < unicorn_http.patch
make http # rebuild parser
ruby -I lib str_modify.rb # success (no output)

In my proposed patch, I call rb_str_resize() instead of rb_str_set_len() 
and that seems to
work around the issue.  I even call rb_str_modify() an extra time before 
rb_str_set_len(),
but rb_str_set_len() still raises...