Backport #4493
closed
Patch: MRI 1.8.7: syck: fix buffer overflow when parsing YAML from a String.
Description
=begin
Certain sequences of tokens will cause syck.c store a NULL string terminator outside the allocated p->buffer when parsing from a large YAML string, causing memory corruption leading to SEGV faults.
The problem was discovered by completely disabling MRI's GC, by changing gc.c:rb_newobj() to call xalloc() directly and returning immediately in gc.c:garbage_collect() and then running REE under valgrind. REE stack clearing code was also disabled. Problem was also visible by directly instrumenting syck.c with mprotect().
The patch is applicable to REE 1.8 and MRI 1.8.7:
- Replaces the confusing logic in syck.c:syck_io_str_read() with behavior similar to syck_io_file_read().
- Enables ASSERT() by default.
- syck_assert() now takes a string msg.
- syck_assert() calls rb_raise() instead of calling abort().
- Removes a bogus ASSERT() that always fails under MRI unit tests.
This patch does not fix unterminated quoted strings that would normally raise a parsing error under psych.
See http://code.google.com/p/rubyenterpriseedition/issues/detail?id=66 for patch.
Contact me directly for specific test cases, instrumentation patches, etc.
=end
Updated by