Use-after-free is possible graphql-c_parser if Bison moves GraphQL-Ruby AST nodes into the heap. Bison's heap is not scanned by Ruby's garbage collector, so if GC runs during this stage, Ruby determines those objects to be dead. Later, however, graphql-c_parser uses those objects again while continuing to parse.
Patched versions use Bison's YYSTACK_USE_ALLOCA 1 configuration to use stack memory instead.
This issue was reported by PlatformSecurity.
hiimguardian Reporter
rmosolgo Remediation developer
Use-after-free is possible
graphql-c_parserif Bison moves GraphQL-Ruby AST nodes into the heap. Bison's heap is not scanned by Ruby's garbage collector, so if GC runs during this stage, Ruby determines those objects to be dead. Later, however,graphql-c_parseruses those objects again while continuing to parse.Patched versions use Bison's
YYSTACK_USE_ALLOCA 1configuration to use stack memory instead.This issue was reported by PlatformSecurity.