Skip to content

Commit 6d33e91

Browse files
authored
Fix memory corruption with FFI backend (#180)
To reproduce with JRuby or TruffleRuby: ```ruby require "fiddle" 1000.times do Fiddle::Pointer[rand(255).chr*16] end ``` `put_string` adds a null byte at the end vs `write_bytes`. This is not caught by the bounds check since the underlying `FFI::Pointer` size is not set.
1 parent 582f443 commit 6d33e91

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

lib/fiddle/ffi_backend.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ def self.from_native(value, ctx)
240240
def self.to_ptr(value)
241241
if value.is_a?(String)
242242
cptr = Pointer.malloc(value.bytesize)
243-
cptr.ffi_ptr.put_string(0, value)
243+
cptr.ffi_ptr.put_bytes(0, value)
244244
cptr
245245

246246
elsif value.is_a?(Array)
@@ -412,7 +412,7 @@ def to_s(len = nil)
412412
if len
413413
ffi_ptr.read_string(len)
414414
else
415-
ffi_ptr.get_string(0)
415+
ffi_ptr.get_string(0, @size)
416416
end
417417
rescue FFI::NullPointerError
418418
raise DLError.new("NULL pointer access")

0 commit comments

Comments
 (0)