https://gitlab.synchro.net/main/sbbs/-/commit/3e714141aa290190f0f09cdd
Modified Files:
src/syncterm/wren/vm/wren_vm.c
Log Message:
Wren: close upvalues on fiber abort to prevent UAF
runtimeError() unwound the caller chain without calling
closeUpvalues() on the aborting fibers. Every other code path
that ends a function's stack � CODE_RETURN, CODE_CLOSE_UPVALUE �
closes upvalues first; the abort path was the lone exception.
A closure created inside an aborted frame that survives (held by
a module-level static, a host callback, an observer list, ...) keeps
upvalues whose `value` pointers still point INTO the dead fiber's
stack. Once GC reclaims the dead fiber and DEALLOCATEs its stack,
subsequent reads through those upvalues return whatever now lives
at that address � silently wrong values at best, SIGSEGV at worst
when the freed memory gets recycled into something whose bytes
decode as a tagged pointer to a stale ObjUpvalue.
Reproducer (200 fibers each capture and abort, then read back):
before � 194 of 200 closures returned the wrong value
after � 0 of 200 wrong
Filed upstream as wren-lang/wren#1234.
Co-Authored-By: Claude Opus 4.7 (1M context) <
[email protected]>
---
� Synchronet � Vertrauen � Home of Synchronet � [vert/cvs/bbs].synchro.net