Reported by Alexandr Savca in https://hackerone.com/reports/1178562
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67950 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This fixes CVE-2021-31810.
Reported by Alexandr Savca.
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67949 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ruby/rdoc] Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799
https://github.com/ruby/rdoc/commit/a7f5d6ab88
The test for command injection on Unix platforms should be omitted on Windows
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67947 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ruby/resolv] Fix confusion of received response message
This is a follow up for commit 33fb966197f1 ("Remove sender/message_id
pair after response received in resolv", 2020-09-11).
As the @senders instance variable is also used for tracking transaction
ID allocation, simply removing an entry without releasing the ID would
eventually deplete the ID space and cause
Resolv::DNS.allocate_request_id to hang.
It seems the intention of the code was to check that the received DNS
message is actually the response for the question made within the method
earlier. Let's have it actually do so.
[Bug #12838] https://bugs.ruby-lang.org/issues/12838
[Bug #17748] https://bugs.ruby-lang.org/issues/17748https://github.com/ruby/resolv/commit/53ca9c9209
---
lib/resolv.rb | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67946 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[Bug #17780] Fix Method#super_method for module alias
Method#super_method crashes for aliased module methods because they are
not defined on a class. This bug was introduced in
c60aaed1856b2b6f90de0992c34771830019e021 as part of bug #17130.
---
proc.c | 2 +-
test/ruby/test_method.rb | 13 +++++++++++++
2 files changed, 14 insertions(+), 1 deletion(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67945 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
note that this is not a security fix, but recognized as critical build problem.
[Backport #17777]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67942 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix singleton class cloning
Before this commit, `clone` gave different results depending on whether the original object
had an attached singleton class or not.
Consider the following setup:
```
class Foo; end
Foo.singleton_class.define_method(:foo) {}
obj = Foo.new
obj.singleton_class if $call_singleton
clone = obj.clone
```
When `$call_singleton = false`, neither `obj.singleton_class.singleton_class` nor
`clone.singleton_class.singleton_class` own any methods.
However, when `$call_singleton = true`, `clone.singleton_class.singleton_class` would own a copy of
`foo` from `Foo.singleton_class`, even though `obj.singleton_class.singleton_class` does not.
The latter case is unexpected and results in a visibly different clone, depending on if the original object
had an attached class or not.
Co-authored-by: Ufuk Kayserilioglu <ufuk.kayserilioglu@shopify.com>
---
class.c | 31 ++++++++++++++++++++++---------
test/ruby/test_class.rb | 47 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 69 insertions(+), 9 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67935 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Don't double fractional seconds when passing timezone object to Time.new
I found that fractional seconds were doubled when using the timezone
feature of Time in Sequel's named_timezones extension (which uses
TZInfo for the timezone object), and traced the problem to this code.
There is no subsecx being modified in the utc_to_local call below
this, and I'm not sure why you would want to add in the fractional
seconds unless you assumed the timezone conversion would drop the
existing fractional seconds (TZInfo doesn't drop fractional seconds).
Subsecond of Time::tm should be 0
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67934 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix Method#super_method for aliased methods
Previously, Method#super_method looked at the called_id to
determine the method id to use, but that isn't correct for
aliased methods, because the super target depends on the
original method id, not the called_id.
Additionally, aliases can reference methods defined in other
classes and modules, and super lookup needs to start in the
super of the defined class in such cases.
This adds tests for Method#super_method for both types of
aliases, one that uses VM_METHOD_TYPE_ALIAS and another that
does not. Both check that the results for calling super
methods return the expected values.
To find the defined class for alias methods, add an rb_ prefix
to find_defined_class_by_owner in vm_insnhelper.c and make it
non-static, so that it can be called from method_super_method
in proc.c.
This bug was original discovered while researching [Bug #11189].
Fixes [Bug #17130]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67933 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Don't require sub-word atomics
On some architectures (like RISC-V) sub-word atomics are only available
when linking against -latomic, but the configure script doesn't do that,
causing the atomic checks to fail and the resulting ruby binary is
non-functional. Ruby does not use sub-word atomic operations, rb_atomic_t
is defined to unsigned int, so use unsigned int when checking for atomic
operations.
---
configure.ac | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67932 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Allow Dir.home to work for non-login procs when $HOME not set
Allow the 'Dir.home' method to reliably locate the user's home directory when
all three of the following are true at the same time:
1. Ruby is running on a Unix-like OS
2. The $HOME environment variable is not set
3. The process is not a descendant of login(1) (or a work-alike)
The prior behavior was that the lookup could only work for login-descended
processes.
This is accomplished by looking up the user's record in the password database
by uid (getpwuid_r(3)) as a fallback to the lookup by name (getpwname_r(3))
which is still attempted first (based on the name, if any, returned by
getlogin_r(3)).
If getlogin_r(3), getpwnam_r(3), and/or getpwuid_r(3) is not available at
compile time, will fallback on using their respective non-*_r() variants:
getlogin(3), getpwnam(3), and/or getpwuid(3).
The rationale for attempting to do the lookup by name prior to doing it by uid
is to accommodate the possibility of multiple login names (each with its own
record in the password database, so each with a potentially different home
directory) being mapped to the same uid (as is explicitly allowed for by
POSIX; see getlogin(3posix)).
Preserves the existing behavior for login-descended processes, and adds the
new capability of having Dir.home being able to find the user's home directory
for non-login-descended processes.
Fixes [Bug #16787]
Related discussion:
https://bugs.ruby-lang.org/issues/16787https://github.com/ruby/ruby/pull/3034
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67931 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Remove sender/message_id pair after response received in resolv
Once a response for a given DNS request has been received (which
requires a matching message id), the [sender, message_id] pair
should be removed from the list of valid senders. This makes it
so duplicate responses from the same sender are ignored.
Fixes [Bug #12838]
---
lib/resolv.rb | 2 +-
test/resolv/test_dns.rb | 113 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 114 insertions(+), 1 deletion(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67929 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Capture to reserved name variables if already defined [Bug #17533]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67927 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Adjust sp for `x = false; y = (return until x unless x)` [Bug #16695]
test/ruby/test_syntax.rb: avoid "warning: assigned but unused
variable"
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67925 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
configure.ac: Bump the size of sigaltstack
The RubyVM uses C macro defines to feature detect whether
`backtrace(2)` support is available, and if so it includes C level backtraces
when the RubyVM itself crashes.
But on my machine, C level backtraces from `vm_dump.c` didn't work when
using a version of Ruby buillt on the machine, but worked fine when using a
version of Ruby built on another machine and copied to my machine.
The default autoconf test for backtraces uses a sigaltstack size that is
too small, so the SIGSEGV signal handler itself causes a SIGSEGV).
I noticed that signal.c uses a larger sigaltstack size:
https://github.com/ruby/ruby/blob/v2_6_5/signal.c#L568
The specific variables it looks at:
- `HAVE_BACKTRACE`
this is a macro defined by autoconf because there is a line in the
configure script like `AC_CHECK_FUNCS(backtrace)` (see the autoconf
docs for more).
- `BROKEN_BACKTRACE`
this comes from a custom program that Ruby's configure script runs to
attempt to figure out whether actually using backtrace(2) in a real
program works. You can see the autoconf program here.
<https://github.com/ruby/ruby/blob/v2_6_5/configure.ac#L2817-L2863>
It uses sigaltstack and SA_ONSTACK to create a seperate stack for
handling signals.
The problem was: SIGSTKSZ (which comes from a system header!) was not
suggesting a large enough stack size. When checking on an Ubuntu 16.04
box, we found that SIGSTKSZ was 8192 and MINSIGSTKSZ was 2048.
---
configure.ac | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67924 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix pthread_setname_np arguments on NetBSD
The previous attempt to fix this in
b87df1bf243074edb2e6cc8a24bc00df81cebf3c reversed the argument
order instead of just fixing the quote escaping.
From Takahiro Kambe.
Fixes [Bug #15178]
---
configure.ac | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67923 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Add operator info to OP_ASGN2 of RubyVM::AbstractSyntaxTree.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67921 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fixed infinite loop at error in printing cause [Bug #17033]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67913 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Correctly remove temporary directory if path yielded is mutated
Another approach would be to freeze the string, but that could
cause backwards compatibility issues.
Fixes [Bug #16918]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67910 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix crashes in the peephole optimizer on OpenBSD/sparc64
These crashes are due to alignment issues, casting ADJUST to INSN
and then accessing after the end of the ADJUST. These patches
come from Stefan Sperling <stsp@apache.org>, who reported the
issue.
---
compile.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67908 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
brace the fact that lchmod(2) can EOPNOTSUPP
Musl libc has this function as a tiny wrapper of fchmodat(3posix). On
the other hand Linux kernel does not support changing modes of a symlink.
The operation always fails with EOPNOTSUPP. This fchmodat behaviour is
defined in POSIX. We have to take care of such exceptions.
---
lib/fileutils.rb | 3 ++-
test/pathname/test_pathname.rb | 2 +-
test/ruby/test_notimp.rb | 19 ++++++++++++-------
3 files changed, 15 insertions(+), 9 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67907 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ripper] fix mismatched indentations warning [Bug #16981]
The scanner location has to be set from lex.ptok before it is
flushed by dispatching the scanner event.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67906 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix wrong "void value expression" error
* parse.y (value_expr_check): if either of then or else statements is not a void value expression, the whole if is not also a void value expression. [Bug #15932]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67903 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Don't display singleton class in Method#inspect unless method defined there
Previously, if an object has a singleton class, and you call
Object#method on the object, the resulting string would include
the object's singleton class, even though the method was not
defined in the singleton class.
Change this so the we only show the singleton class if the method
is defined in the singleton class.
Fixes [Bug #15608]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67902 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
