CVE-2021-4110 (published 2021-12-15T05:15Z)

mruby is vulnerable to NULL Pointer Dereference

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2021-12-14 13:35:18+09:00
msg: proc.c: add `mrb_state` argument to `mrb_proc_copy()`.

The function may invoke the garbage collection and it requires
`mrb_state` to run.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: proc.h
change_type: ModificationType.MODIFY
diff: @@ -92,7 +92,7 @@ struct RProc *mrb_proc_new(mrb_state*, const mrb_irep*);
 struct RProc *mrb_closure_new(mrb_state*, const mrb_irep*);
 MRB_API struct RProc *mrb_proc_new_cfunc(mrb_state*, mrb_func_t);
 MRB_API struct RProc *mrb_closure_new_cfunc(mrb_state *mrb, mrb_func_t func, int nlocals);
-void mrb_proc_copy(struct RProc *a, struct RProc *b);
+void mrb_proc_copy(mrb_state *mrb, struct RProc *a, struct RProc *b);
 mrb_int mrb_proc_arity(const struct RProc *p);
 
 /* following functions are defined in mruby-proc-ext so please include it when using */

programming_language: C
filename: class.c
change_type: ModificationType.MODIFY
diff: @@ -2569,7 +2569,7 @@ mrb_mod_define_method_m(mrb_state *mrb, struct RClass *c)
     mrb_raise(mrb, E_ARGUMENT_ERROR, "no block given");
   }
   p = MRB_OBJ_ALLOC(mrb, MRB_TT_PROC, mrb->proc_class);
-  mrb_proc_copy(p, mrb_proc_ptr(blk));
+  mrb_proc_copy(mrb, p, mrb_proc_ptr(blk));
   p->flags |= MRB_PROC_STRICT;
   MRB_METHOD_FROM_PROC(m, p);
   mrb_define_method_raw(mrb, c, mid, m);

programming_language: C
filename: proc.c
change_type: ModificationType.MODIFY
diff: @@ -201,7 +201,7 @@ mrb_proc_cfunc_env_get(mrb_state *mrb, mrb_int idx)
 }
 
 void
-mrb_proc_copy(struct RProc *a, struct RProc *b)
+mrb_proc_copy(mrb_state *mrb, struct RProc *a, struct RProc *b)
 {
   if (a->body.irep) {
     /* already initialized proc */
@@ -209,10 +209,10 @@ mrb_proc_copy(struct RProc *a, struct RProc *b)
   }
   a->flags = b->flags;
   a->body = b->body;
+  a->upper = b->upper;
   if (!MRB_PROC_CFUNC_P(a) && a->body.irep) {
-    mrb_irep_incref(NULL, (mrb_irep*)a->body.irep);
+    mrb_irep_incref(mrb, (mrb_irep*)a->body.irep);
   }
-  a->upper = b->upper;
   a->e.env = b->e.env;
   /* a->e.target_class = a->e.target_class; */
 }
@@ -227,7 +227,7 @@ mrb_proc_s_new(mrb_state *mrb, mrb_value proc_class)
   /* Calling Proc.new without a block is not implemented yet */
   mrb_get_args(mrb, "&!", &blk);
   p = MRB_OBJ_ALLOC(mrb, MRB_TT_PROC, mrb_class_ptr(proc_class));
-  mrb_proc_copy(p, mrb_proc_ptr(blk));
+  mrb_proc_copy(mrb, p, mrb_proc_ptr(blk));
   proc = mrb_obj_value(p);
   mrb_funcall_with_block(mrb, proc, MRB_SYM(initialize), 0, NULL, proc);
   if (!MRB_PROC_STRICT_P(p) &&
@@ -245,7 +245,7 @@ mrb_proc_init_copy(mrb_state *mrb, mrb_value self)
   if (!mrb_proc_p(proc)) {
     mrb_raise(mrb, E_ARGUMENT_ERROR, "not a proc");
   }
-  mrb_proc_copy(mrb_proc_ptr(self), mrb_proc_ptr(proc));
+  mrb_proc_copy(mrb, mrb_proc_ptr(self), mrb_proc_ptr(proc));
   return self;
 }
 
@@ -281,7 +281,7 @@ proc_lambda(mrb_state *mrb, mrb_value self)
   p = mrb_proc_ptr(blk);
   if (!MRB_PROC_STRICT_P(p)) {
     struct RProc *p2 = MRB_OBJ_ALLOC(mrb, MRB_TT_PROC, p->c);
-    mrb_proc_copy(p2, p);
+    mrb_proc_copy(mrb, p2, p);
     p2->flags |= MRB_PROC_STRICT;
     return mrb_obj_value(p2);
   }

programming_language: C