# \[bug:trunk\] Invalid read of size 4 by redefining load

**URL:** <https://www.ruby-forum.com/t/bug-trunk-invalid-read-of-size-4-by-redefining-load/183841>\
**Category:** Development\
**Created:** [February 21, 2010, 5:20pm UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-read-of-size-4-by-redefining-load/183841 "2010-02-21T17:20:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [February 21, 2010, 5:20pm UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-read-of-size-4-by-redefining-load/183841/1 "2010-02-21T17:20:53Z")

</div>

e$B0J2\<$N$h$&$Ke(B load e$BCf$Ke(B load  
e$B$r:FDj5A$9$k$H!“JQ$J$H$3$m$r%”%/%;%9$9$k$N$,e(B  
valgrind e$B$G4QB,$5$l$^$9!#e(B

% cat tst.rb  
module Kernel  
def load(\*args)  
end  
end  
raise  
% valgrind ./ruby -ve ‘load “tst.rb”’  
==12820== Memcheck, a memory error detector.  
==12820== Copyright © 2002-2007, and GNU GPL’d, by Julian Seward et  
al.  
==12820== Using LibVEX rev 1854, a library for dynamic binary  
translation.  
==12820== Copyright © 2004-2007, and GNU GPL’d, by OpenWorks LLP.  
==12820== Using valgrind-3.3.1-Debian, a dynamic binary  
instrumentation framework.  
==12820== Copyright © 2000-2007, and GNU GPL’d, by Julian Seward et  
al.  
==12820== For more details, rerun with: -v  
==12820==  
ruby 1.9.2dev (2010-02-21 trunk 26723) [i686-linux]  
tst.rb:2: warning: method redefined; discarding old load  
==12820== Invalid read of size 4  
==12820== at 0x814EA8F: vm\_backtrace\_each (vm.c:737)  
==12820== by 0x814EBF2: vm\_backtrace (vm.c:771)  
==12820== by 0x814D1EE: rb\_make\_backtrace (vm\_eval.c:1590)  
==12820== by 0x805EB30: setup\_exception (eval.c:378)  
==12820== by 0x805F142: rb\_raise\_jump (eval.c:573)  
==12820== by 0x805EF34: rb\_f\_raise (eval.c:503)  
==12820== by 0x8147821: call\_cfunc (vm\_insnhelper.c:290)  
==12820== by 0x81476F9: vm\_call\_cfunc (vm\_insnhelper.c:377)  
==12820== by 0x8146CC2: vm\_call\_method (vm\_insnhelper.c:500)  
==12820== by 0x81428F8: vm\_exec\_core (insns.def:999)  
==12820== by 0x814F7C5: vm\_exec (vm.c:1132)  
==12820== by 0x814FF65: rb\_iseq\_eval (vm.c:1359)  
==12820== Address 0x434c014 is 4 bytes inside a block of size 16 free’d  
==12820== at 0x4022B8A: free (vg\_replace\_malloc.c:323)  
==12820== by 0x8063B6E: vm\_xfree (gc.c:731)  
==12820== by 0x8063CC5: ruby\_xfree (gc.c:779)  
==12820== by 0x814848B: rb\_free\_method\_entry (vm\_method.c:141)  
==12820== by 0x814881B: rb\_add\_method\_def (vm\_method.c:213)  
==12820== by 0x81489EC: rb\_add\_method (vm\_method.c:263)  
==12820== by 0x8150D8E: vm\_define\_method (vm.c:1846)  
==12820== by 0x8150E3E: m\_core\_define\_method (vm.c:1862)  
==12820== by 0x81478B8: call\_cfunc (vm\_insnhelper.c:302)  
==12820== by 0x81476F9: vm\_call\_cfunc (vm\_insnhelper.c:377)  
==12820== by 0x8146CC2: vm\_call\_method (vm\_insnhelper.c:500)  
==12820== by 0x81428F8: vm\_exec\_core (insns.def:999)  
==12820==  
==12820== Invalid read of size 4  
==12820== at 0x814EAAD: vm\_backtrace\_each (vm.c:740)  
==12820== by 0x814EBF2: vm\_backtrace (vm.c:771)  
==12820== by 0x814D1EE: rb\_make\_backtrace (vm\_eval.c:1590)  
==12820== by 0x805EB30: setup\_exception (eval.c:378)  
==12820== by 0x805F142: rb\_raise\_jump (eval.c:573)  
==12820== by 0x805EF34: rb\_f\_raise (eval.c:503)  
==12820== by 0x8147821: call\_cfunc (vm\_insnhelper.c:290)  
==12820== by 0x81476F9: vm\_call\_cfunc (vm\_insnhelper.c:377)  
==12820== by 0x8146CC2: vm\_call\_method (vm\_insnhelper.c:500)  
==12820== by 0x81428F8: vm\_exec\_core (insns.def:999)  
==12820== by 0x814F7C5: vm\_exec (vm.c:1132)  
==12820== by 0x814FF65: rb\_iseq\_eval (vm.c:1359)  
==12820== Address 0x434c018 is 8 bytes inside a block of size 16 free’d  
==12820== at 0x4022B8A: free (vg\_replace\_malloc.c:323)  
==12820== by 0x8063B6E: vm\_xfree (gc.c:731)  
==12820== by 0x8063CC5: ruby\_xfree (gc.c:779)  
==12820== by 0x814848B: rb\_free\_method\_entry (vm\_method.c:141)  
==12820== by 0x814881B: rb\_add\_method\_def (vm\_method.c:213)  
==12820== by 0x81489EC: rb\_add\_method (vm\_method.c:263)  
==12820== by 0x8150D8E: vm\_define\_method (vm.c:1846)  
==12820== by 0x8150E3E: m\_core\_define\_method (vm.c:1862)  
==12820== by 0x81478B8: call\_cfunc (vm\_insnhelper.c:302)  
==12820== by 0x81476F9: vm\_call\_cfunc (vm\_insnhelper.c:377)  
==12820== by 0x8146CC2: vm\_call\_method (vm\_insnhelper.c:500)  
==12820== by 0x81428F8: vm\_exec\_core (insns.def:999)  
tst.rb:5:in `<top (required)>': unhandled exception from -e:1:in`load’  
from -e:1:in `’  
==12820==  
==12820== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 29 from  
1)  
==12820== malloc/free: in use at exit: 615,707 bytes in 14,666 blocks.  
==12820== malloc/free: 16,023 allocs, 1,357 frees, 1,662,183 bytes  
allocated.  
==12820== For counts of detected errors, rerun with: -v  
==12820== searching for pointers to 14,666 not-freed blocks.  
==12820== checked 451,824 bytes.  
==12820==  
==12820== LEAK SUMMARY:  
==12820== definitely lost: 467,917 bytes in 9,809 blocks.  
==12820== possibly lost: 0 bytes in 0 blocks.  
==12820== still reachable: 147,790 bytes in 4,857 blocks.  
==12820== suppressed: 0 bytes in 0 blocks.  
==12820== Rerun with --leak-check=full to see details of leaked memory.

---

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [February 22, 2010, 7:03am UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-read-of-size-4-by-redefining-load/183841/2 "2010-02-22T07:03:47Z")

</div>

e$B$J$+$@$G$9!#e(B

At Mon, 22 Feb 2010 01:20:07 +0900,  
Tanaka A. wrote in [ruby-dev:40452]:

> e$B0J2\<$N$h$&$Ke(B load e$BCf$Ke(B load e$B$r:FDj5A$9$k$H!“JQ$J$H$3$m$r%”%/%;%9$9$k$N$,e(B  
> valgrind e$B$G4QB,$5$l$^$9!#e(B

rb\_method\_entry\_te$B$K$be(Brefcounte$B$rF~$l$^$9$+$M$’!#e(B

---

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [February 22, 2010, 8:14am UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-read-of-size-4-by-redefining-load/183841/3 "2010-02-22T08:14:36Z")

</div>

(2010/02/22 15:03), Nobuyoshi N. wrote::

> rb\_method\_entry\_te$B$K$be(Brefcounte$B$rF~$l$^$9$+$M$’!#e(B

e$B!!@-G=$N4QE@$+$iH?BP$7$^$9!%e(B

e$B!!$5$C$-$Ne(B IRC  
e$B$K=q$$$?FbMF$G$9$,!$$3$s$J46$8$G$I$&$G$7$g$&$+!%Bg6D$J5$e(B  
e$B$b$7$^$9$,!%e(B

(1) unlink e$B$5$l$?e(B me e$B$rJ]B8$7$F$\*$/e(B  
(2)  
e$B0lDj$N%?%$%_%s%0!JB?J,!$e(BGCe$B%?%$%_%s%0!K$G%U%l!\<%`$rAv::$7$Fe(B  
e$B!!!J]B8$7$?e(B me e$B$Ke(B mark  
(3) mark e$B$,$D$$$F$J$$$N$r\>C$9!Je(Bsweepe$B!Ke(B

e$B!!e(BNODE e$B$KLa$9$C$F$N$b0l0F$G$9$,e(B…e$B!%e(B

---

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [May 5, 2010, 7:58pm UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-read-of-size-4-by-redefining-load/183841/4 "2010-05-05T19:58:38Z")

</div>

e$B%A%1%C%He(B #2777 e$B$,99?7$5$l$^$7$?!#e(B (by Koichi Sasada)

e$B%9%F!\<%?%9e(B Opene$B$+$ie(BClosede$B$KJQ99e(B  
e$B?JD=e(B % 0e$B$+$ie(B100e$B$KJQ99e(B

This issue was solved with changeset r27634.  
Nobuyoshi, thank you for reporting this issue.  
Your contribution to Ruby is greatly appreciated.  
May Ruby be with you.

* * *

[http://redmine.ruby-lang.org/issues/show/2777](http://redmine.ruby-lang.org/issues/show/2777)

---

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [April 20, 2010, 2:33pm UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-read-of-size-4-by-redefining-load/183841/5 "2010-04-20T14:33:44Z")

</div>

e$B%A%1%C%He(B #2777 e$B$,99?7$5$l$^$7$?!#e(B (by Yusuke E.)

e$BC4Ev\<Te(B Koichi Sasadae$B$K%;%C%He(B  
e$BM%@hEYe(B Lowe$B$+$ie(BNormale$B$KJQ99e(B  
Target version 1.9.2e$B$K%;%C%He(B  
ruby -v -e$B$K%;%C%He(B

e$B1sF#$G$9!#e(B

> % cat tst.rb  
> module Kernel  
> def load(\*args)  
> end  
> end  
> raise  
> % valgrind ./ruby -ve ‘load “tst.rb”’  
> _snip_

e$B$H$$$&%_%j%8%J%k$NLdBj$Oe(B r27393  
e$B$G9_L/$K2sHr$5$l$^$7$?$,!"K\<AE\*$K$Oe(B  
e$B2r7h$7$F$\*$i$:!"0J2\<$Ge(B SEGV e$B$7$^$9!#e(B

class C  
define\_method(:foo) do  
C.class\_eval { remove\_method(:foo) }  
super()  
end  
end  
C.new.foo

e$B$"$H!"e(Br27393 e$B$@$He(B rb\_method\_definition\_t  
e$B$N;2\>H$r8:$i$7$F$$$J$$$N$Ge(B  
e$B%a%b%j%j!\<%/$9$k$h$&$J5$$,$7$^$9!#e(B

diff --git a/vm\_method.c b/vm\_method.c  
index 04b62f2…c9d99db 100644  
— a/vm\_method.c  
+++ b/vm\_method.c  
@@ -215,6 +215,14 @@ rb\_add\_method\_def(VALUE klass, ID mid,  
rb\_method\_type\_t type, rb\_method\_definiti  
\* another problem when the usage is changed.  
\*/  
me = old\_me;  
+

- if (me-\>def) {
- 

```
 if (me->def->alias_count == 0)

```

- xfree(me-\>def);
- 

```
 else if (me->def->alias_count > 0)

```

- me-\>def-\>alias\_count–;
- 

```
 me->def = 0;

```

- }  
}  
else {  
me = ALLOC(rb\_method\_entry\_t);

## – Yusuke E. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

[http://redmine.ruby-lang.org/issues/show/2777](http://redmine.ruby-lang.org/issues/show/2777)