https://git.ruby-lang.org/ruby.git/commit/?id=26c179d7e7

From 26c179d7e7e7ae0eb21050659c3e8778358230ab Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@r...>
Date: Tue, 16 Jun 2020 01:03:15 +0900
Subject: Check argument to ObjectSpace._id2ref

Ensure that the argument is an Integer or implicitly convert to,
before dereferencing as a Bignum.  Addressed a regression in
b99833baec2.

Reported by u75615 at https://hackerone.com/reports/898614

diff --git a/gc.c b/gc.c
index b8c5239..29ae8e5 100644
--- a/gc.c
+++ b/gc.c
@@ -3716,6 +3716,7 @@ id2ref(VALUE objid) https://github.com/ruby/ruby/blob/trunk/gc.c#L3716
     VALUE orig;
     void *p0;
 
+    objid = rb_to_int(objid);
     if (FIXNUM_P(objid) || rb_big_size(objid) <= SIZEOF_VOIDP) {
         ptr = NUM2PTR(objid);
         if (ptr == Qtrue) return Qtrue;
diff --git a/test/ruby/test_objectspace.rb b/test/ruby/test_objectspace.rb
index 243e9f6..02c20aa 100644
--- a/test/ruby/test_objectspace.rb
+++ b/test/ruby/test_objectspace.rb
@@ -55,6 +55,16 @@ End https://github.com/ruby/ruby/blob/trunk/test/ruby/test_objectspace.rb#L55
     EOS
   end
 
+  def test_id2ref_invalid_argument
+    msg = /no implicit conversion/
+    assert_raise_with_message(TypeError, msg) {ObjectSpace._id2ref(nil)}
+    assert_raise_with_message(TypeError, msg) {ObjectSpace._id2ref(false)}
+    assert_raise_with_message(TypeError, msg) {ObjectSpace._id2ref(true)}
+    assert_raise_with_message(TypeError, msg) {ObjectSpace._id2ref(:a)}
+    assert_raise_with_message(TypeError, msg) {ObjectSpace._id2ref("0")}
+    assert_raise_with_message(TypeError, msg) {ObjectSpace._id2ref(Object.new)}
+  end
+
   def test_count_objects
     h = {}
     ObjectSpace.count_objects(h)
-- 
cgit v0.10.2


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/