take-cheeze / mruby-marshal

mruby implementation of cruby marshaling.
12 stars 9 forks source link

Marshal.dump crashing #21

Closed WaveformDelta closed 6 years ago

WaveformDelta commented 6 years ago

I have a build of mRuby using this gem that crashes on calls to Marshal.dump.

> o = [:one, :two, :three]
  => [:one, :two, :three]
> m = Marshal.dump(o)
Segmentation fault: 11

It crashes in line 27 of marshal.cpp, right in this code:

bool operator!=(mrb_value const& lhs, mrb_sym const sym) {
  return !mrb_symbol_p(lhs) || mrb_symbol(lhs) != sym;
}

I'm building for iOS and macOS, and the code has been working; I had not tried using dump until now.

WaveformDelta commented 6 years ago

Further research shows that dump does work in certain cases. For example

> o = ['one', 'two', 'three']
 => ["one", "two", "three"]
> Marshal.dump(o)
 => "\004\b[\b\"\bone\"\btwo\"\nthree"

It seems to work with string objects, but not other types of object.

take-cheeze commented 6 years ago

@WaveformDelta Thanks for the report. Somehow I accessed the memory address before checking the range. Should be fixed by #22 .

It would be helpful if you reported the version of mruby(release or git commit hash). I've tried in latest mruby and it didn't reproduced, though 1.3 reproduced this. Anyway thank you.

WaveformDelta commented 6 years ago

Thanks for the fix!! I'm actually running this against the current tip of stable, mRuby 1.3.0 (277391e1b2).

I also noticed you had an earlier fix for a memory access error in 30b949ce...I was curious: wouldn't it need the same fix on line 31 for the operator==?