CVE-2018-12248: Out-of-bounds Read (CWE-125)
value: An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2018-06-12T14:29Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-fiber/src/fiber.c
Commit date: 2018-06-07 15:59:00 +0900
Commit message: Extend stack when pushing arguments that does not fit in; fix #4038

Diff: diff --git a/mrbgems/mruby-fiber/src/fiber.c b/mrbgems/mruby-fiber/src/fiber.c
index 83153a9df..b88fa4949 100644
--- a/mrbgems/mruby-fiber/src/fiber.c
+++ b/mrbgems/mruby-fiber/src/fiber.c
@@ -182,30 +182,31 @@ fiber_switch_context(mrb_state *mrb, struct mrb_context *c)
 static mrb_value
 fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mrb_bool resume, mrb_bool vmexec)
 {
   struct mrb_context *c = fiber_check(mrb, self);
   struct mrb_context *old_c = mrb->c;
+  enum mrb_fiber_state status;
   mrb_value value;
 
   fiber_check_cfunc(mrb, c);
-  if (resume && c->status == MRB_FIBER_TRANSFERRED) {
+  status = c->status;
+  if (resume && status == MRB_FIBER_TRANSFERRED) {
     mrb_raise(mrb, E_FIBER_ERROR, "resuming transferred fiber");
   }
-  if (c->status == MRB_FIBER_RUNNING || c->status == MRB_FIBER_RESUMED) {
+  if (status == MRB_FIBER_RUNNING || status == MRB_FIBER_RESUMED) {
     mrb_raise(mrb, E_FIBER_ERROR, "double resume (fib)");
   }
-  if (c->status == MRB_FIBER_TERMINATED) {
+  if (status == MRB_FIBER_TERMINATED) {
     mrb_raise(mrb, E_FIBER_ERROR, "resuming dead fiber");
   }
-  mrb->c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
+  old_c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
   c->prev = resume ? mrb->c : (c->prev ? c->prev : mrb->root_c);
-  if (c->status == MRB_FIBER_CREATED) {
+  fiber_switch_context(mrb, c);
+  if (status == MRB_FIBER_CREATED) {
     mrb_value *b, *e;
 
-    if (len >= c->stend - c->stack) {
-      mrb_raise(mrb, E_FIBER_ERROR, "too many arguments to fiber");
-    }
+    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
     b = c->stack+1;
     e = b + len;
     while (b<e) {
       *b++ = *a++;
     }
@@ -213,11 +214,10 @@ fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr
     value = c->stack[0] = MRB_PROC_ENV(c->ci->proc)->stack[0];
   }
   else {
     value = fiber_result(mrb, a, len);
   }
-  fiber_switch_context(mrb, c);
 
   if (vmexec) {
     c->vmexec = TRUE;
     value = mrb_vm_exec(mrb, c->ci[-1].proc, c->ci->pc);
     mrb->c = old_c;

Vulnerable code:   if (resume && c->status == MRB_FIBER_TRANSFERRED) {
  if (c->status == MRB_FIBER_RUNNING || c->status == MRB_FIBER_RESUMED) {
  if (c->status == MRB_FIBER_TERMINATED) {
  mrb->c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
  if (c->status == MRB_FIBER_CREATED) {
    if (len >= c->stend - c->stack) {
      mrb_raise(mrb, E_FIBER_ERROR, "too many arguments to fiber");
    }
  fiber_switch_context(mrb, c);
Fixed code:   enum mrb_fiber_state status;
  status = c->status;
  if (resume && status == MRB_FIBER_TRANSFERRED) {
  if (status == MRB_FIBER_RUNNING || status == MRB_FIBER_RESUMED) {
  if (status == MRB_FIBER_TERMINATED) {
  old_c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
  fiber_switch_context(mrb, c);
  if (status == MRB_FIBER_CREATED) {
    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */