May 2025 - ruby-core - ml.ruby-lang.org

[ruby-core:121872] [Ruby Bug#18878] parse.y: Foo::Bar {} is inconsistently rejected
by mame (Yusuke Endoh) 07 May '25

07 May '25

Issue #18878 has been updated by mame (Yusuke Endoh). Status changed from Open to Assigned Assignee set to ydah (Yudai Takada) ---------------------------------------- Bug #18878: parse.y: Foo::Bar {} is inconsistently rejected https://bugs.ruby-lang.org/issues/18878#change-112939 * Author: qnighy (Masaki Hara) * Status: Assigned * Assignee: ydah (Yudai Takada) * ruby -v: ruby 3.1.2p20 (2022-04-12 revision 4491bb740a) [x86_64-linux] * Backport: 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN ---------------------------------------- The following source doesn't parse: ```ruby Foo::Bar {} ``` despite the following: ```ruby bar # local variable or method call Bar # constant bar() # method call Bar() # method call bar {} # method call Bar {} # method call bar() {} # method call Bar() {} # method call Foo::bar # method call Foo::Bar # constant Foo::bar() # method call Foo::Bar() # method call Foo::bar {} # method call # Foo::Bar {} # SyntaxError Foo::bar() {} # method call Foo::Bar() {} # method call ``` Especially considering `Bar {}`, this looks like a missing implementation rather than an intentional behavior. -- https://bugs.ruby-lang.org/

1 0

[ruby-core:121713] [Ruby Misc#21281] DevMeeting-2025-05-08
by mame (Yusuke Endoh) 07 May '25

07 May '25

Issue #21281 has been reported by mame (Yusuke Endoh). ---------------------------------------- Misc #21281: DevMeeting-2025-05-08 https://bugs.ruby-lang.org/issues/21281 * Author: mame (Yusuke Endoh) * Status: Open ---------------------------------------- # The next dev meeting **Date: 2025/05/08 13:00-17:00** (JST) Log: *TBD* - Dev meeting *IS NOT* a decision-making place. All decisions should be done at the bug tracker. - Dev meeting is a place we can ask Matz, nobu, nurse and other developers directly. - Matz is a very busy person. Take this opportunity to ask him. If you can not attend, other attendees can ask instead of you (if attendees can understand your issue). - We will write a record of the discussion in the file or to each ticket in English. - All activities are best-effort (keep in mind that most of us are volunteer developers). - The date, time and place of the meeting are scheduled according to when/where we can reserve Matz's time. - *DO NOT* discuss then on this ticket, please. # Call for agenda items If you have a ticket that you want matz and committers to discuss, please post it into this ticket in the following format: ``` * [Ticket ref] Ticket title (your name) * Comment (A summary of the ticket, why you put this ticket here, what point should be discussed, etc.) ``` Example: ``` * [Feature #14609] `Kernel#p` without args shows the receiver (ko1) * I feel this feature is very useful and some people say :+1: so let discuss this feature. ``` - It is recommended to add a comment by 2025/05/05. We hold a preparatory meeting to create an agenda a few days before the dev-meeting. - The format is strict. We'll use [this script to automatically create an markdown-style agenda](https://gist.github.com/mame/b0390509ce1491b43610b9ebb665eb86). We may ignore a comment that does not follow the format. - Your comment is mandatory. We cannot read all discussion of the ticket in a limited time. We appreciate it if you could write a short summary and update from a previous discussion. -- https://bugs.ruby-lang.org/

6 6

[ruby-core:114025] [Ruby master Feature#19744] Namespace on read
by tagomoris (Satoshi TAGOMORI) 06 May '25

06 May '25

Issue #19744 has been reported by tagomoris (Satoshi TAGOMORI). ---------------------------------------- Feature #19744: Namespace on read https://bugs.ruby-lang.org/issues/19744 * Author: tagomoris (Satoshi TAGOMORI) * Status: Open * Priority: Normal ---------------------------------------- # What is the "Namespace on read" This proposes a new feature to define virtual top-level namespaces in Ruby. Those namespaces can require/load libraries (either .rb or native extension) separately from the global namespace. Dependencies of required/loaded libraries are also required/loaded in the namespace. ### Motivation The "namespace on read" can solve the 2 problems below, and can make a path to solve another problem: The details of those motivations are described in the below section ("Motivation details"). #### Avoiding name conflicts between libraries Applications can require two different libraries safely which use the same module name. #### Avoiding unexpected globally shared modules/objects Applications can make an independent/unshared module instance. #### (In the future) Multiple versions of gems can be required Application developers will have fewer version conflicts between gem dependencies if rubygems/bundler will support the namespace on read. ### Example code with this feature ```ruby # your_module module YourModule end # my_module.rb require 'your_module' module MyModule end # example.rb namespace1 = NameSpace.new namespace1.require('my_module') #=> true namespace1::MyModule #=> #<Module:0x00000001027ea650>::MyModule (or #<NameSpace:0x00...>::MyModule ?) namespace1::YourModule # similar to the above MyModule # NameError YourModule # NameError namespace2 = NameSpace.new # Any number of namespaces can be defined namespace2.require('my_module') # Different library "instance" from namespace1 require 'my_module' # require in the global namespace MyModule.object_id != namespace1::MyModule.object_id #=> true namespace1::MyModule.object_id != namespace2::MyModule.object_id ``` The required/loaded libraries will define different "instances" of modules/classes in those namespaces (just like the "wrapper" 2nd argument of `Kernel.load`). This doesn't introduce compatibility problems if all libraries use relative name resolution (without forced top-level reference like `::Name`). # "On read": optional, user-driven feature "On read" is a key thing of this feature. That means: * No changes are required in existing/new libraries (except for limited cases, described below) * No changes are required in applications if it doesn't need namespaces * Users can enable/use namespaces just for limited code in the whole library/application Users can start using this feature step by step (if they want it) without any big jumps. ## Motivation details This feature can solve multiple problems I have in writing/executing Ruby code. Those are from the 3 problems I mentioned above: name conflicts, globally shared modules, and library version conflicts between dependencies. I'll describe 4 scenarios about those problems. ### Running multiple applications on a Ruby process Modern computers have many CPU cores and large memory spaces. We sometimes want to have many separate applications (either micro-service architecture or modular monolith). Currently, running those applications require different processes. It requires additional computation costs (especially in developing those applications). If we have isolated namespaces and can load applications in those namespaces, we'll be able to run apps on a process, with less overhead. (I want to run many AWS Lambda applications on a process in isolated namespaces.) ### Running tests in isolated namespaces Tests that require external libraries need many hacks to: * require a library multiple times * require many different 3rd party libraries into isolated spaces (those may conflict with each other) Software with plugin systems (for example, Fluentd) will get benefit from namespaces. In addition to it, application tests can avoid unexpected side effects if tests are executed in isolated namespaces. ### Safely isolated library instances Libraries may have globally shared states. For example, [Oj](https://github.com/ohler55/oj) has a global `Obj.default_options` object to change the library behavior. Those options may be changed by any dependency libraries or applications, and it changes the behavior of `Oj` globally, unexpectedly. For such libraries, we'll be able to instantiate a safe library instance in an isolated namespace. ### Avoiding dependency hells Modern applications use many libraries, and those libraries require much more dependencies. Those dependencies will cause version conflicts very often. In such cases, application developers should resolve those by updating each libraries, or should just wait for the new release of libraries to conflict those libraries. Sometimes, library maintainers don't release updated versions, and application developers can do nothing. If namespaces can require/load a library multiple times, it also enables to require/load different versions of a library in a process. It requires the support of rubygems, but namespaces should be a good fundamental of it. ## Expected problems ### Use of top-level references In my expectation, `::Name` should refer the top-level `Name` in the global namespace. I expect that `::ENV` should contain the environment variables. But it may cause compatibility problems if library code uses `::MyLibrary` to refer themselves in their deeply nested library code. ### Additional memory consumption An extension library (dynamically linked library) may be loaded multiple times (by `dlopen` for temporarily copied dll files) to load isolated library "instances" if different namespaces require the same extension library. That consumes additional memory. In my opinion, additional memory consumption is a minimum cost to realize loading extension libraries multiple times without compatibility issues. This occurs only when programmers use namespaces. And it's only about libraries that are used in 2 or more namespaces. ### The change of `dlopen` flag about extension libraries To load an extension library multiple times without conflicting symbols, all extensions should stop sharing symbols globally. Libraries referring symbols from other extension libraries will have to change code & dependencies. (About the things about extension libraries, [Naruse also wrote an entry](https://naruse.hateblo.jp/entry/2023/05/22/193411).) # Misc The proof-of-concept branch is here: https://github.com/tagomoris/ruby/pull/1 It's still work-in-progress branch, especially for extension libraries. -- https://bugs.ruby-lang.org/

17 70

[ruby-core:120619] [Ruby master Bug#21030] Bug: #step with Range<ActiveSupport::Duration> behavior broken on Ruby 3.4.1
by johnnyshields (Johnny Shields) 05 May '25

05 May '25

Issue #21030 has been reported by johnnyshields (Johnny Shields). ---------------------------------------- Bug #21030: Bug: #step with Range<ActiveSupport::Duration> behavior broken on Ruby 3.4.1 https://bugs.ruby-lang.org/issues/21030 * Author: johnnyshields (Johnny Shields) * Status: Open * Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- Issue also filed at: https://github.com/rails/rails/issues/54199 ### System configuration **Rails version**: 7.1.5.1 **Ruby version**: 3.3.4 (works) vs 3.4.1 (broken) ### What's broken Calling `#step` then `#to_a` on a `Range` whose beginning/end values are the same is expected to return an `Array` wrapping the `Range`'s singular value. In other words, `(x..x).step(n).to_a` should return `[x]` -- note this is also the same as `(x..x).to_a` The following case breaks on Ruby 3.4.1 related to `ActiveSupport::Duration` class, where it returns an empty array. It works on Ruby 3.3. Both tested with Rails 7.1.5.1. It's very easy to reproduce. I'm unsure if this is a Ruby bug or a Rails bug so I'm filing it in both places. The upgrade of Ruby is what produces the difference. ```ruby require 'active_support/all' # version 7.1.5.1 int = 100 dur = 100.seconds # ActiveSupport/Duration # The bug (dur..dur).step(10).to_a # => Ruby 3.3 returns [100 seconds] - CORRECT # => Ruby 3.4 returns [] - INCORRECT (int..dur).step(10).to_a # => Ruby 3.3 returns [100] - CORRECT # => Ruby 3.4 returns [] - INCORRECT # Note the following cases work correctly on both Ruby versions: (int..int).step(10).to_a #=> [100] (int..dur).to_a #=> [100] # Range with non-equivalent values also works fine on different versions: dur2 = 120.seconds (dur..dur2).step(10).to_a #=> [100 seconds, 110 seconds, 120 seconds] (int..dur2).step(10).to_a #=> [100, 110, 120] ``` -- https://bugs.ruby-lang.org/

6 10

[ruby-core:120855] [Ruby master Bug#21104] Net::HTTP connections failing in Ruby >= 3.4.0 on macOS with Happy Eyeballs enabled
by mjt58 (Mike Thompson) 05 May '25

05 May '25

Issue #21104 has been reported by mjt58 (Mike Thompson). ---------------------------------------- Bug #21104: Net::HTTP connections failing in Ruby >= 3.4.0 on macOS with Happy Eyeballs enabled https://bugs.ruby-lang.org/issues/21104 * Author: mjt58 (Mike Thompson) * Status: Open * ruby -v: ruby 3.4.1 (2024-12-25 revision 48d4efcb85) +PRISM [arm64-darwin24] * Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- A project I work on recently upgraded Ruby to 3.4.1 from 3.3.5. Following the upgrade, and when running locally on my Mac, all attempts to connect to an external service within the project over http(s) fail. We use `mise` for managing development tool dependencies, including Ruby, and I am using macOS 15.3. For example running something as simple as: ``` require 'net/http' puts Net::HTTP.get(URI('https://bbc.co.uk')) ``` Will fail with the following stack trace: ``` /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/protocol.rb:46:in 'OpenSSL::SSL::SSLSocket#connect_nonblock': Connection reset by peer - SSL_connect (Errno::ECONNRESET) from /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/protocol.rb:46:in 'Net::Protocol#ssl_socket_connect' from /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/http.rb:1736:in 'Net::HTTP#connect' from /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/http.rb:1636:in 'Net::HTTP#do_start' from /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/http.rb:1625:in 'Net::HTTP#start' from /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/http.rb:1064:in 'Net::HTTP.start' from /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/http.rb:824:in 'Net::HTTP.get_response' from /path/to/.local/share/mise/installs/ruby/3.4.1/lib/ruby/3.4.0/net/http.rb:805:in 'Net::HTTP.get' from request.rb:2:in '<main>' ``` I tried different versions of Ruby and confirmed that the issue appears with 3.4.0. After reading the release notes for this version, I tried setting `RUBY_TCP_NO_FAST_FALLBACK=1` and this worked, allowing me to work around the problem. This issue has also been encountered by others, please see: https://github.com/rubygems/rubygems/issues/8390 -- https://bugs.ruby-lang.org/

6 13

[ruby-core:121801] [Ruby Bug#21301] Invalid Dates Accepted When Using "UTC" in Time.new
by mame (Yusuke Endoh) 04 May '25

04 May '25

Issue #21301 has been reported by mame (Yusuke Endoh). ---------------------------------------- Bug #21301: Invalid Dates Accepted When Using "UTC" in Time.new https://bugs.ruby-lang.org/issues/21301 * Author: mame (Yusuke Endoh) * Status: Open * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- 2025-04-31 does not exist, but, when creating a time object with the "UTC" zone, the value is accepted without error: ```ruby Time.new(2025, 4, 31, 0, 0, 0, "UTC") #=> expected: 2025-05-01 00:00:00 UTC #=> actual: 2025-04-31 00:00:00 UTC ``` In contrast, using the "+00:00" time zone works as expected and rolls the date over to 2025-05-01: ```ruby Time.new(2025, 4, 31, 0, 0, 0, "+00:00") # => 2025-05-01 00:00:00 +0000 ``` Note that 2025-04-30T24:00:00Z is correctly rolled over to 2025-05-01T00:00:00Z. And 2025-04-31T24:00:00Z is rolled over to 2025-04-01! ```ruby Time.new(2025, 4, 30, 24, 0, 0, "UTC") #=> 2025-05-01 00:00:00 UTC # OK Time.new(2025, 4, 31, 24, 0, 0, "UTC") #=> 2025-04-01 00:00:00 UTC # What? ``` -- https://bugs.ruby-lang.org/

2 3

[ruby-core:121809] [Ruby Bug#21306] heap-use-after-free in set initialization via clearing the array while it’s being iterated
by cyruscyliu (Qiang Liu) 03 May '25

03 May '25

Issue #21306 has been reported by cyruscyliu (Qiang Liu). ---------------------------------------- Bug #21306: heap-use-after-free in set initialization via clearing the array while it’s being iterated https://bugs.ruby-lang.org/issues/21306 * Author: cyruscyliu (Qiang Liu) * Status: Open * ruby -v: 3.5.0 * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- Hi, we found a heap-use-after-free in set initialization via clearing the array while it’s being iterated. Here is the PoC. ``` $a = (1..100).to_a s = Set.new($a) { |x| $a.clear } ``` Initializing a Set with an array that has a block modifying the array causes memory corruption. In this case, the block clears $a while Set is being initialized, which can lead to inconsistent internal state and potential crashes. To reproduce, compile the recent Ruby with ASAN, and run the PoC. ``` $ git log | head -n3 commit 36c64b3be83f17992137d63ffd0b94f90e24424a Author: John Hawthorn <john(a)hawthorn.email> Date: Fri Apr 11 16:02:23 2025 -070 ./ruby set_initialize.rb `RubyGems' were not loaded. `error_highlight' was not loaded. `did_you_mean' was not loaded. `syntax_suggest' was not loaded. ================================================================= ==107246==ERROR: AddressSanitizer: heap-use-after-free on address 0x51900000dc88 at pc 0x5de0c6510d40 bp 0x7ffc82400690 sp 0x7ffc82400688 READ of size 8 at 0x51900000dc88 thread T0 #0 0x5de0c6510d3f in set_i_initialize /media/test/ruby/build/../set.c:502:17 #1 0x5de0c6658bb1 in vm_call0_cfunc_with_frame /media/test/ruby/build/../vm_eval.c:164:15 #2 0x5de0c6658bb1 in vm_call0_cfunc /media/test/ruby/build/../vm_eval.c:178:12 #3 0x5de0c6658bb1 in vm_call0_body /media/test/ruby/build/../vm_eval.c:229:15 #4 0x5de0c665c443 in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #5 0x5de0c665c443 in rb_call0 /media/test/ruby/build/../vm_eval.c:554:12 #6 0x5de0c6613825 in rb_call /media/test/ruby/build/../vm_eval.c:873:12 #7 0x5de0c6613825 in rb_funcallv_kw /media/test/ruby/build/../vm_eval.c:1070:12 #8 0x5de0c63edc54 in rb_class_new_instance_pass_kw /media/test/ruby/build/../object.c:2203:5 #9 0x5de0c6646b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #10 0x5de0c662f4e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #11 0x5de0c662efd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #12 0x5de0c65f7f98 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #13 0x5de0c65f7f98 in vm_exec_core /media/test/ruby/build/../insns.def:851:11 #14 0x5de0c65eda47 in rb_vm_exec /media/test/ruby/build/../vm.c #15 0x5de0c62bfce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #16 0x5de0c62bfce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #17 0x5de0c62bb3a0 in rb_main /media/test/ruby/build/../main.c:42:12 #18 0x5de0c62bb3a0 in main /media/test/ruby/build/../main.c:62:12 #19 0x77f098629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #20 0x77f098629e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #21 0x5de0c61e3d54 in _start (/media/test/ruby/build/ruby+0x148d54) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) 0x51900000dc88 is located 8 bytes inside of 1024-byte region [0x51900000dc80,0x51900000e080) freed by thread T0 here: #0 0x5de0c627e37c in realloc (/media/test/ruby/build/ruby+0x1e337c) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) #1 0x5de0c6320acb in rb_gc_impl_realloc /media/test/ruby/build/../gc/default/default.c:8330:5 #2 0x5de0c62fdfd9 in ruby_sized_xrealloc2_body /media/test/ruby/build/../gc.c:4772:12 #3 0x5de0c62fdfd9 in ruby_sized_xrealloc2 /media/test/ruby/build/../gc.c:4765:34 #4 0x5de0c62fdfd9 in ruby_xrealloc2 /media/test/ruby/build/../gc.c:4778:12 #5 0x5de0c66add64 in ary_heap_realloc /media/test/ruby/build/../array.c:370:5 #6 0x5de0c66add64 in ary_resize_capa /media/test/ruby/build/../array.c:412:24 #7 0x5de0c66b5663 in rb_ary_clear /media/test/ruby/build/../array.c:4750:13 #8 0x5de0c6646b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #9 0x5de0c662f4e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #10 0x5de0c662efd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #11 0x5de0c65f51d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #12 0x5de0c65f51d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #13 0x5de0c65eda47 in rb_vm_exec /media/test/ruby/build/../vm.c #14 0x5de0c66607b6 in invoke_iseq_block_from_c /media/test/ruby/build/../vm.c:1648:12 #15 0x5de0c66607b6 in invoke_block_from_c_bh /media/test/ruby/build/../vm.c:1662:20 #16 0x5de0c661502a in vm_yield_with_cref /media/test/ruby/build/../vm.c:1699:12 #17 0x5de0c661502a in vm_yield /media/test/ruby/build/../vm.c:1707:12 #18 0x5de0c661502a in rb_yield_0 /media/test/ruby/build/../vm_eval.c:1344:12 #19 0x5de0c661502a in rb_yield /media/test/ruby/build/../vm_eval.c #20 0x5de0c6510aa4 in set_i_initialize /media/test/ruby/build/../set.c:502:17 #21 0x5de0c6658bb1 in vm_call0_cfunc_with_frame /media/test/ruby/build/../vm_eval.c:164:15 #22 0x5de0c6658bb1 in vm_call0_cfunc /media/test/ruby/build/../vm_eval.c:178:12 #23 0x5de0c6658bb1 in vm_call0_body /media/test/ruby/build/../vm_eval.c:229:15 #24 0x5de0c665c443 in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #25 0x5de0c665c443 in rb_call0 /media/test/ruby/build/../vm_eval.c:554:12 #26 0x5de0c6613825 in rb_call /media/test/ruby/build/../vm_eval.c:873:12 #27 0x5de0c6613825 in rb_funcallv_kw /media/test/ruby/build/../vm_eval.c:1070:12 #28 0x5de0c63edc54 in rb_class_new_instance_pass_kw /media/test/ruby/build/../object.c:2203:5 #29 0x5de0c6646b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #30 0x5de0c662f4e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #31 0x5de0c662efd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #32 0x5de0c65f7f98 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #33 0x5de0c65f7f98 in vm_exec_core /media/test/ruby/build/../insns.def:851:11 #34 0x5de0c65eda47 in rb_vm_exec /media/test/ruby/build/../vm.c #35 0x5de0c62bfce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #36 0x5de0c62bfce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #37 0x5de0c62bb3a0 in rb_main /media/test/ruby/build/../main.c:42:12 #38 0x5de0c62bb3a0 in main /media/test/ruby/build/../main.c:62:12 #39 0x77f098629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 previously allocated by thread T0 here: #0 0x5de0c627e37c in realloc (/media/test/ruby/build/ruby+0x1e337c) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) #1 0x5de0c6320acb in rb_gc_impl_realloc /media/test/ruby/build/../gc/default/default.c:8330:5 #2 0x5de0c62fdfd9 in ruby_sized_xrealloc2_body /media/test/ruby/build/../gc.c:4772:12 #3 0x5de0c62fdfd9 in ruby_sized_xrealloc2 /media/test/ruby/build/../gc.c:4765:34 #4 0x5de0c62fdfd9 in ruby_xrealloc2 /media/test/ruby/build/../gc.c:4778:12 #5 0x5de0c66add64 in ary_heap_realloc /media/test/ruby/build/../array.c:370:5 #6 0x5de0c66add64 in ary_resize_capa /media/test/ruby/build/../array.c:412:24 #7 0x5de0c66ad51b in ary_double_capa /media/test/ruby/build/../array.c:461:5 #8 0x5de0c66ad51b in ary_ensure_room_for_push /media/test/ruby/build/../array.c:620:9 #9 0x5de0c66ad0c4 in rb_ary_push /media/test/ruby/build/../array.c:1386:24 #10 0x5de0c68aceb9 in collect_all /media/test/ruby/build/../enum.c:636:5 #11 0x5de0c65e9803 in vm_yield_with_cfunc /media/test/ruby/build/../vm_insnhelper.c:5146:11 #12 0x5de0c66601f8 in invoke_block_from_c_bh /media/test/ruby/build/../vm.c:1667:16 #13 0x5de0c661502a in vm_yield_with_cref /media/test/ruby/build/../vm.c:1699:12 #14 0x5de0c661502a in vm_yield /media/test/ruby/build/../vm.c:1707:12 #15 0x5de0c661502a in rb_yield_0 /media/test/ruby/build/../vm_eval.c:1344:12 #16 0x5de0c661502a in rb_yield /media/test/ruby/build/../vm_eval.c #17 0x5de0c6444d87 in range_each_fixnum_loop /media/test/ruby/build/../range.c:1059:9 #18 0x5de0c6444d87 in range_each /media/test/ruby/build/../range.c:1096:16 #19 0x5de0c6658bb1 in vm_call0_cfunc_with_frame /media/test/ruby/build/../vm_eval.c:164:15 #20 0x5de0c6658bb1 in vm_call0_cfunc /media/test/ruby/build/../vm_eval.c:178:12 #21 0x5de0c6658bb1 in vm_call0_body /media/test/ruby/build/../vm_eval.c:229:15 #22 0x5de0c665c443 in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #23 0x5de0c665c443 in rb_call0 /media/test/ruby/build/../vm_eval.c:554:12 #24 0x5de0c6616955 in rb_call /media/test/ruby/build/../vm_eval.c:873:12 #25 0x5de0c6616955 in iterate_method /media/test/ruby/build/../vm_eval.c:1528:12 #26 0x5de0c6616f55 in rb_iterate0 /media/test/ruby/build/../vm_eval.c:1470:18 #27 0x5de0c66167c9 in rb_iterate_internal /media/test/ruby/build/../vm_eval.c:1502:12 #28 0x5de0c66167c9 in rb_block_call_kw /media/test/ruby/build/../vm_eval.c:1551:12 #29 0x5de0c68a7b7b in enum_to_a /media/test/ruby/build/../enum.c:735:5 #30 0x5de0c6658bb1 in vm_call0_cfunc_with_frame /media/test/ruby/build/../vm_eval.c:164:15 #31 0x5de0c6658bb1 in vm_call0_cfunc /media/test/ruby/build/../vm_eval.c:178:12 #32 0x5de0c6658bb1 in vm_call0_body /media/test/ruby/build/../vm_eval.c:229:15 #33 0x5de0c6611076 in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #34 0x5de0c6611076 in rb_vm_call0 /media/test/ruby/build/../vm_eval.c:61:12 #35 0x5de0c6611076 in rb_vm_call_kw /media/test/ruby/build/../vm_eval.c:326:12 #36 0x5de0c6611076 in vm_call_super /media/test/ruby/build/../vm_eval.c:350:12 #37 0x5de0c6611076 in rb_call_super_kw /media/test/ruby/build/../vm_eval.c:358:12 #38 0x5de0c6646b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #39 0x5de0c662f4e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #40 0x5de0c662efd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #41 0x5de0c65f51d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #42 0x5de0c65f51d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #43 0x5de0c65eda47 in rb_vm_exec /media/test/ruby/build/../vm.c #44 0x5de0c62bfce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #45 0x5de0c62bfce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #46 0x5de0c62bb3a0 in rb_main /media/test/ruby/build/../main.c:42:12 #47 0x5de0c62bb3a0 in main /media/test/ruby/build/../main.c:62:12 #48 0x77f098629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-use-after-free /media/test/ruby/build/../set.c:502:17 in set_i_initialize Shadow bytes around the buggy address: 0x51900000da00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x51900000da80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x51900000db00: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa 0x51900000db80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51900000dc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x51900000dc80: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000dd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000dd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000de00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000de80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000df00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==107246==ABORTING ../triaged/set_initialize.rb:3: [BUG] ASAN error ruby 3.5.0dev (2025-05-02T21:28:25Z master 36c64b3be8) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:0004 p:---- s:0015 e:000014 CFUNC :initialize c:0003 p:---- s:0012 e:000011 CFUNC :new c:0002 p:0013 s:0007 E:000c48 EVAL ../triaged/set_initialize.rb:3 [FINISH] c:0001 p:0000 s:0003 E:000540 DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- ../triaged/set_initialize.rb:3:in '<main>' ../triaged/set_initialize.rb:3:in 'new' ../triaged/set_initialize.rb:3:in 'initialize' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- ./ruby(___interceptor_backtrace) [0x5de0c6228006] /media/test/ruby/build/ruby(rb_print_backtrace+0x14) [0x5de0c6976337] /media/test/ruby/build/../vm_dump.c:839 /media/test/ruby/build/ruby(rb_vm_bugreport) /media/test/ruby/build/../vm_dump.c:1171 /media/test/ruby/build/ruby(rb_bug_without_die_internal+0x23c) [0x5de0c68ca76c] /media/test/ruby/build/../error.c:1097 /media/test/ruby/build/ruby(rb_bug_without_die+0x127) [0x5de0c68ca487] /media/test/ruby/build/../error.c:1106 ./ruby(0x5de0c62a1bc6) [0x5de0c62a1bc6] ./ruby(0x5de0c6282c9f) [0x5de0c6282c9f] ./ruby(0x5de0c6285ce5) [0x5de0c6285ce5] ./ruby(__asan_report_load8) [0x5de0c6286988] /media/test/ruby/build/ruby(set_i_initialize+0x4c0) [0x5de0c6510d40] /media/test/ruby/build/../set.c:502 /media/test/ruby/build/ruby(vm_call0_cfunc_with_frame+0x280) [0x5de0c6658bb2] ../vm_eval.c:164 /media/test/ruby/build/ruby(vm_call0_cfunc) ../vm_eval.c:178 /media/test/ruby/build/ruby(vm_call0_body) ../vm_eval.c:229 /media/test/ruby/build/ruby(vm_call0_cc+0x141) [0x5de0c665c444] ../vm_eval.c:101 /media/test/ruby/build/ruby(rb_call0) ../vm_eval.c:554 /media/test/ruby/build/ruby(rb_funcallv_kw+0x86) [0x5de0c6613826] ../vm_eval.c:873 /media/test/ruby/build/ruby(rb_class_new_instance_pass_kw+0x35) [0x5de0c63edc55] /media/test/ruby/build/../object.c:2203 /media/test/ruby/build/ruby(vm_cfp_consistent_p+0x0) [0x5de0c6646b3c] ../vm_insnhelper.c:3797 /media/test/ruby/build/ruby(vm_call_cfunc_with_frame_) ../vm_insnhelper.c:3799 /media/test/ruby/build/ruby(vm_call_method_each_type+0x264) [0x5de0c662f4e4] ../vm_insnhelper.c:4775 ./ruby(vm_call_method+0x2d4) [0x5de0c662efd4] /media/test/ruby/build/ruby(vm_sendish+0x10e) [0x5de0c65f7f99] ../vm_insnhelper.c:5972 /media/test/ruby/build/ruby(vm_exec_core) ../insns.def:851 ./ruby(vm_exec_loop+0x0) [0x5de0c65eda48] /media/test/ruby/build/ruby(rb_vm_exec) /media/test/ruby/build/../vm.c:2621 /media/test/ruby/build/ruby(rb_ec_exec_node+0x53) [0x5de0c62bfce1] /media/test/ruby/build/../eval.c:281 /media/test/ruby/build/ruby(ruby_run_node) /media/test/ruby/build/../eval.c:319 /media/test/ruby/build/ruby(rb_main+0x29) [0x5de0c62bb3a1] /media/test/ruby/build/../main.c:42 /media/test/ruby/build/ruby(main) /media/test/ruby/build/../main.c:62 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_call_main+0x80) [0x77f098629d90] ../sysdeps/nptl/libc_start_call_main.h:58 /lib/x86_64-linux-gnu/libc.so.6(call_init+0x0) [0x77f098629e40] ../csu/libc-start.c:392 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main_impl) ../csu/libc-start.c:379 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main) (null):0 ./ruby(_start) [0x5de0c61e3d55] -- Other runtime information ----------------------------------------------- * Loaded script: ../triaged/set_initialize.rb * Loaded features: 0 enumerator.so 1 thread.rb 2 fiber.so 3 rational.so 4 complex.so 5 ruby2_keywords.rb 6 set.rb ``` -- https://bugs.ruby-lang.org/

3 2

[ruby-core:121808] [Ruby Bug#21305] heap-use-after-free of set#merge via mutating hash method
by cyruscyliu (Qiang Liu) 03 May '25

03 May '25

Issue #21305 has been reported by cyruscyliu (Qiang Liu). ---------------------------------------- Bug #21305: heap-use-after-free of set#merge via mutating hash method https://bugs.ruby-lang.org/issues/21305 * Author: cyruscyliu (Qiang Liu) * Status: Open * ruby -v: 3.5.0 * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- Hi, we found a heap-use-after-free of set#merge via mutating hash method. Here is the PoC. ``` class C def hash $a.clear return 0 end end $a = (1..100).to_a $a.insert(0, C.new) $b = Set.new([]) $b.merge($a) ``` Calling Set#merge on a set with an object whose hash method mutates the array causes memory corruption. In this case, C#hash clears $a while Set#merge is iterating over it, breaking internal state and potentially leading to a crash. To reproduce, compile the recent Ruby with ASAN, and run the PoC. ``` $ git log | head -n3 commit 36c64b3be83f17992137d63ffd0b94f90e24424a Author: John Hawthorn <john(a)hawthorn.email> Date: Fri Apr 11 16:02:23 2025 -070 `RubyGems' were not loaded. `error_highlight' was not loaded. `did_you_mean' was not loaded. `syntax_suggest' was not loaded. ================================================================= ==106456==ERROR: AddressSanitizer: heap-use-after-free on address 0x51900000dc88 at pc 0x5c83c02ed8b8 bp 0x7fff8201f1b0 sp 0x7fff8201f1a8 READ of size 8 at 0x51900000dc88 thread T0 #0 0x5c83c02ed8b7 in set_merge_enum_into /media/test/ruby/build/../set.c:1126:13 #1 0x5c83c02eb51f in set_i_merge /media/test/ruby/build/../set.c:1156:9 #2 0x5c83c041eb3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #3 0x5c83c04074e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #4 0x5c83c0406fd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #5 0x5c83c03cd1d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #6 0x5c83c03cd1d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #7 0x5c83c03c5a47 in rb_vm_exec /media/test/ruby/build/../vm.c #8 0x5c83c0097ce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #9 0x5c83c0097ce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #10 0x5c83c00933a0 in rb_main /media/test/ruby/build/../main.c:42:12 #11 0x5c83c00933a0 in main /media/test/ruby/build/../main.c:62:12 #12 0x72c910229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #13 0x72c910229e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #14 0x5c83bffbbd54 in _start (/media/test/ruby/build/ruby+0x148d54) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) 0x51900000dc88 is located 8 bytes inside of 1024-byte region [0x51900000dc80,0x51900000e080) freed by thread T0 here: #0 0x5c83c005637c in realloc (/media/test/ruby/build/ruby+0x1e337c) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) #1 0x5c83c00f8acb in rb_gc_impl_realloc /media/test/ruby/build/../gc/default/default.c:8330:5 #2 0x5c83c00d5fd9 in ruby_sized_xrealloc2_body /media/test/ruby/build/../gc.c:4772:12 #3 0x5c83c00d5fd9 in ruby_sized_xrealloc2 /media/test/ruby/build/../gc.c:4765:34 #4 0x5c83c00d5fd9 in ruby_xrealloc2 /media/test/ruby/build/../gc.c:4778:12 #5 0x5c83c0485d64 in ary_heap_realloc /media/test/ruby/build/../array.c:370:5 #6 0x5c83c0485d64 in ary_resize_capa /media/test/ruby/build/../array.c:412:24 #7 0x5c83c048d663 in rb_ary_clear /media/test/ruby/build/../array.c:4750:13 #8 0x5c83c041eb3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #9 0x5c83c04074e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #10 0x5c83c0406fd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #11 0x5c83c03cd1d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #12 0x5c83c03cd1d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #13 0x5c83c03c5a47 in rb_vm_exec /media/test/ruby/build/../vm.c #14 0x5c83c04308ed in vm_call0_body /media/test/ruby/build/../vm_eval.c:225:20 #15 0x5c83c03eb3bb in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #16 0x5c83c03eb3bb in rb_funcallv_scope /media/test/ruby/build/../vm_eval.c:1047:16 #17 0x5c83c03f3471 in vm_catch_protect /media/test/ruby/build/../vm_eval.c:2612:15 #18 0x5c83c03548b5 in exec_recursive /media/test/ruby/build/../thread.c:5300:22 #19 0x5c83c0100fd3 in obj_any_hash /media/test/ruby/build/../hash.c:238:16 #20 0x5c83c0100cf2 in any_hash /media/test/ruby/build/../hash.c:207:16 #21 0x5c83c02e3c42 in set_do_hash /media/test/ruby/build/../st.c:2349:33 #22 0x5c83c02e3c42 in rb_set_insert /media/test/ruby/build/../st.c:2892:18 #23 0x5c83c02ed75b in set_table_insert_wb /media/test/ruby/build/../set.c:378:15 #24 0x5c83c02ed75b in set_merge_enum_into /media/test/ruby/build/../set.c:1126:13 #25 0x5c83c02eb51f in set_i_merge /media/test/ruby/build/../set.c:1156:9 #26 0x5c83c041eb3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #27 0x5c83c04074e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #28 0x5c83c0406fd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #29 0x5c83c03cd1d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #30 0x5c83c03cd1d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #31 0x5c83c03c5a47 in rb_vm_exec /media/test/ruby/build/../vm.c #32 0x5c83c0097ce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #33 0x5c83c0097ce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #34 0x5c83c00933a0 in rb_main /media/test/ruby/build/../main.c:42:12 #35 0x5c83c00933a0 in main /media/test/ruby/build/../main.c:62:12 #36 0x72c910229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 previously allocated by thread T0 here: #0 0x5c83c005637c in realloc (/media/test/ruby/build/ruby+0x1e337c) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) #1 0x5c83c00f8acb in rb_gc_impl_realloc /media/test/ruby/build/../gc/default/default.c:8330:5 #2 0x5c83c00d5fd9 in ruby_sized_xrealloc2_body /media/test/ruby/build/../gc.c:4772:12 #3 0x5c83c00d5fd9 in ruby_sized_xrealloc2 /media/test/ruby/build/../gc.c:4765:34 #4 0x5c83c00d5fd9 in ruby_xrealloc2 /media/test/ruby/build/../gc.c:4778:12 #5 0x5c83c0485d64 in ary_heap_realloc /media/test/ruby/build/../array.c:370:5 #6 0x5c83c0485d64 in ary_resize_capa /media/test/ruby/build/../array.c:412:24 #7 0x5c83c048551b in ary_double_capa /media/test/ruby/build/../array.c:461:5 #8 0x5c83c048551b in ary_ensure_room_for_push /media/test/ruby/build/../array.c:620:9 #9 0x5c83c04850c4 in rb_ary_push /media/test/ruby/build/../array.c:1386:24 #10 0x5c83c0684eb9 in collect_all /media/test/ruby/build/../enum.c:636:5 #11 0x5c83c03c1803 in vm_yield_with_cfunc /media/test/ruby/build/../vm_insnhelper.c:5146:11 #12 0x5c83c04381f8 in invoke_block_from_c_bh /media/test/ruby/build/../vm.c:1667:16 #13 0x5c83c03ed02a in vm_yield_with_cref /media/test/ruby/build/../vm.c:1699:12 #14 0x5c83c03ed02a in vm_yield /media/test/ruby/build/../vm.c:1707:12 #15 0x5c83c03ed02a in rb_yield_0 /media/test/ruby/build/../vm_eval.c:1344:12 #16 0x5c83c03ed02a in rb_yield /media/test/ruby/build/../vm_eval.c #17 0x5c83c021cd87 in range_each_fixnum_loop /media/test/ruby/build/../range.c:1059:9 #18 0x5c83c021cd87 in range_each /media/test/ruby/build/../range.c:1096:16 #19 0x5c83c0430bb1 in vm_call0_cfunc_with_frame /media/test/ruby/build/../vm_eval.c:164:15 #20 0x5c83c0430bb1 in vm_call0_cfunc /media/test/ruby/build/../vm_eval.c:178:12 #21 0x5c83c0430bb1 in vm_call0_body /media/test/ruby/build/../vm_eval.c:229:15 #22 0x5c83c0434443 in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #23 0x5c83c0434443 in rb_call0 /media/test/ruby/build/../vm_eval.c:554:12 #24 0x5c83c03ee955 in rb_call /media/test/ruby/build/../vm_eval.c:873:12 #25 0x5c83c03ee955 in iterate_method /media/test/ruby/build/../vm_eval.c:1528:12 #26 0x5c83c03eef55 in rb_iterate0 /media/test/ruby/build/../vm_eval.c:1470:18 #27 0x5c83c03ee7c9 in rb_iterate_internal /media/test/ruby/build/../vm_eval.c:1502:12 #28 0x5c83c03ee7c9 in rb_block_call_kw /media/test/ruby/build/../vm_eval.c:1551:12 #29 0x5c83c067fb7b in enum_to_a /media/test/ruby/build/../enum.c:735:5 #30 0x5c83c0430bb1 in vm_call0_cfunc_with_frame /media/test/ruby/build/../vm_eval.c:164:15 #31 0x5c83c0430bb1 in vm_call0_cfunc /media/test/ruby/build/../vm_eval.c:178:12 #32 0x5c83c0430bb1 in vm_call0_body /media/test/ruby/build/../vm_eval.c:229:15 #33 0x5c83c03e9076 in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #34 0x5c83c03e9076 in rb_vm_call0 /media/test/ruby/build/../vm_eval.c:61:12 #35 0x5c83c03e9076 in rb_vm_call_kw /media/test/ruby/build/../vm_eval.c:326:12 #36 0x5c83c03e9076 in vm_call_super /media/test/ruby/build/../vm_eval.c:350:12 #37 0x5c83c03e9076 in rb_call_super_kw /media/test/ruby/build/../vm_eval.c:358:12 #38 0x5c83c041eb3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #39 0x5c83c04074e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #40 0x5c83c0406fd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #41 0x5c83c03cd1d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #42 0x5c83c03cd1d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #43 0x5c83c03c5a47 in rb_vm_exec /media/test/ruby/build/../vm.c #44 0x5c83c0097ce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #45 0x5c83c0097ce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #46 0x5c83c00933a0 in rb_main /media/test/ruby/build/../main.c:42:12 #47 0x5c83c00933a0 in main /media/test/ruby/build/../main.c:62:12 #48 0x72c910229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-use-after-free /media/test/ruby/build/../set.c:1126:13 in set_merge_enum_into Shadow bytes around the buggy address: 0x51900000da00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x51900000da80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x51900000db00: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa 0x51900000db80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51900000dc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x51900000dc80: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000dd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000dd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000de00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000de80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51900000df00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==106456==ABORTING ../triaged/set_merge.rb:11: [BUG] ASAN error ruby 3.5.0dev (2025-05-02T21:28:25Z master 36c64b3be8) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:0003 p:---- s:0011 e:000010 CFUNC :merge c:0002 p:0060 s:0006 e:000005 EVAL ../triaged/set_merge.rb:11 [FINISH] c:0001 p:0000 s:0003 E:000540 DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- ../triaged/set_merge.rb:11:in '<main>' ../triaged/set_merge.rb:11:in 'merge' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- ./ruby(___interceptor_backtrace) [0x5c83c0000006] /media/test/ruby/build/ruby(rb_print_backtrace+0x14) [0x5c83c074e337] /media/test/ruby/build/../vm_dump.c:839 /media/test/ruby/build/ruby(rb_vm_bugreport) /media/test/ruby/build/../vm_dump.c:1171 /media/test/ruby/build/ruby(rb_bug_without_die_internal+0x23c) [0x5c83c06a276c] /media/test/ruby/build/../error.c:1097 /media/test/ruby/build/ruby(rb_bug_without_die+0x127) [0x5c83c06a2487] /media/test/ruby/build/../error.c:1106 ./ruby(0x5c83c0079bc6) [0x5c83c0079bc6] ./ruby(0x5c83c005ac9f) [0x5c83c005ac9f] ./ruby(0x5c83c005dce5) [0x5c83c005dce5] ./ruby(__asan_report_load8) [0x5c83c005e988] /media/test/ruby/build/ruby(set_merge_enum_into+0x428) [0x5c83c02ed8b8] /media/test/ruby/build/../set.c:1126 /media/test/ruby/build/ruby(set_i_merge+0xa0) [0x5c83c02eb520] /media/test/ruby/build/../set.c:1156 /media/test/ruby/build/ruby(vm_cfp_consistent_p+0x0) [0x5c83c041eb3c] ../vm_insnhelper.c:3797 /media/test/ruby/build/ruby(vm_call_cfunc_with_frame_) ../vm_insnhelper.c:3799 /media/test/ruby/build/ruby(vm_call_method_each_type+0x264) [0x5c83c04074e4] ../vm_insnhelper.c:4775 ./ruby(vm_call_method+0x2d4) [0x5c83c0406fd4] /media/test/ruby/build/ruby(vm_sendish+0x1c8) [0x5c83c03cd1d9] ../vm_insnhelper.c:5972 /media/test/ruby/build/ruby(vm_exec_core) ../insns.def:899 ./ruby(vm_exec_loop+0x0) [0x5c83c03c5a48] /media/test/ruby/build/ruby(rb_vm_exec) /media/test/ruby/build/../vm.c:2621 /media/test/ruby/build/ruby(rb_ec_exec_node+0x53) [0x5c83c0097ce1] /media/test/ruby/build/../eval.c:281 /media/test/ruby/build/ruby(ruby_run_node) /media/test/ruby/build/../eval.c:319 /media/test/ruby/build/ruby(rb_main+0x29) [0x5c83c00933a1] /media/test/ruby/build/../main.c:42 /media/test/ruby/build/ruby(main) /media/test/ruby/build/../main.c:62 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_call_main+0x80) [0x72c910229d90] ../sysdeps/nptl/libc_start_call_main.h:58 /lib/x86_64-linux-gnu/libc.so.6(call_init+0x0) [0x72c910229e40] ../csu/libc-start.c:392 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main_impl) ../csu/libc-start.c:379 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main) (null):0 ./ruby(_start) [0x5c83bffbbd55] -- Other runtime information ----------------------------------------------- * Loaded script: ../triaged/set_merge.rb * Loaded features: 0 enumerator.so 1 thread.rb 2 fiber.so 3 rational.so 4 complex.so 5 ruby2_keywords.rb 6 set.rb ``` -- https://bugs.ruby-lang.org/

3 2

[ruby-core:121807] [Ruby Bug#21304] heap-use-after-free of Array#hash via mutating hash method
by cyruscyliu (Qiang Liu) 03 May '25

03 May '25

Issue #21304 has been reported by cyruscyliu (Qiang Liu). ---------------------------------------- Bug #21304: heap-use-after-free of Array#hash via mutating hash method https://bugs.ruby-lang.org/issues/21304 * Author: cyruscyliu (Qiang Liu) * Status: Open * ruby -v: 3.5.0 * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- Hi, we found a heap-use-after-free of Array#hash via mutating hash method. Here is the PoC. ``` class C def hash() puts $a $a.push(*1..100000) return 0 end end c = C.new $a = [c] $a.push(*1..10) $a.hash puts "!" puts $a ``` Calling Array#hash on an array containing an object whose hash method mutates the array causes memory corruption. In this example, C#hash appends a large number of elements to $a while Array#hash is iterating over it, leading to inconsistent internal state and potentially a crash. To reproduce, compile the recent Ruby with ASAN, and run the PoC. ``` $ git log | head -n3 commit 36c64b3be83f17992137d63ffd0b94f90e24424a Author: John Hawthorn <john(a)hawthorn.email> Date: Fri Apr 11 16:02:23 2025 -070 $ ./ruby ../triaged/array_hash.rb `RubyGems' were not loaded. `error_highlight' was not loaded. `did_you_mean' was not loaded. `syntax_suggest' was not loaded. #<C:0x000071c87a142f30> 1 2 3 4 5 6 7 8 9 10 ================================================================= ==105169==ERROR: AddressSanitizer: heap-use-after-free on address 0x511000009c88 at pc 0x601bf620302b bp 0x7ffd48775e70 sp 0x7ffd48775e68 READ of size 8 at 0x511000009c88 thread T0 #0 0x601bf620302a in rb_ary_hash_values /media/test/ruby/build/../array.c:5334:21 #1 0x601bf6193b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #2 0x601bf617c4e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #3 0x601bf617bfd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #4 0x601bf61421d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #5 0x601bf61421d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #6 0x601bf613aa47 in rb_vm_exec /media/test/ruby/build/../vm.c #7 0x601bf5e0cce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #8 0x601bf5e0cce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #9 0x601bf5e083a0 in rb_main /media/test/ruby/build/../main.c:42:12 #10 0x601bf5e083a0 in main /media/test/ruby/build/../main.c:62:12 #11 0x71c87a629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #12 0x71c87a629e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #13 0x601bf5d30d54 in _start (/media/test/ruby/build/ruby+0x148d54) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) 0x511000009c88 is located 8 bytes inside of 216-byte region [0x511000009c80,0x511000009d58) freed by thread T0 here: #0 0x601bf5dcb37c in realloc (/media/test/ruby/build/ruby+0x1e337c) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) #1 0x601bf5e6dacb in rb_gc_impl_realloc /media/test/ruby/build/../gc/default/default.c:8330:5 #2 0x601bf5e4afd9 in ruby_sized_xrealloc2_body /media/test/ruby/build/../gc.c:4772:12 #3 0x601bf5e4afd9 in ruby_sized_xrealloc2 /media/test/ruby/build/../gc.c:4765:34 #4 0x601bf5e4afd9 in ruby_xrealloc2 /media/test/ruby/build/../gc.c:4778:12 #5 0x601bf61fad64 in ary_heap_realloc /media/test/ruby/build/../array.c:370:5 #6 0x601bf61fad64 in ary_resize_capa /media/test/ruby/build/../array.c:412:24 #7 0x601bf61fa51b in ary_double_capa /media/test/ruby/build/../array.c:461:5 #8 0x601bf61fa51b in ary_ensure_room_for_push /media/test/ruby/build/../array.c:620:9 #9 0x601bf6208ba7 in rb_ary_cat /media/test/ruby/build/../array.c:1399:24 #10 0x601bf6208ba7 in rb_ary_push_m /media/test/ruby/build/../array.c:1426:12 #11 0x601bf6193b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #12 0x601bf61421d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #13 0x601bf61421d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #14 0x601bf613aa47 in rb_vm_exec /media/test/ruby/build/../vm.c #15 0x601bf61a58ed in vm_call0_body /media/test/ruby/build/../vm_eval.c:225:20 #16 0x601bf61603bb in vm_call0_cc /media/test/ruby/build/../vm_eval.c:101:12 #17 0x601bf61603bb in rb_funcallv_scope /media/test/ruby/build/../vm_eval.c:1047:16 #18 0x601bf6168471 in vm_catch_protect /media/test/ruby/build/../vm_eval.c:2612:15 #19 0x601bf60c98b5 in exec_recursive /media/test/ruby/build/../thread.c:5300:22 #20 0x601bf5e75fd3 in obj_any_hash /media/test/ruby/build/../hash.c:238:16 #21 0x601bf5e75cf2 in any_hash /media/test/ruby/build/../hash.c:207:16 #22 0x601bf5e7621f in rb_hash /media/test/ruby/build/../hash.c:269:21 #23 0x601bf6202fda in rb_ary_hash_values /media/test/ruby/build/../array.c:5334:13 #24 0x601bf6193b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #25 0x601bf617c4e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #26 0x601bf617bfd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #27 0x601bf61421d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #28 0x601bf61421d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #29 0x601bf613aa47 in rb_vm_exec /media/test/ruby/build/../vm.c #30 0x601bf5e0cce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #31 0x601bf5e0cce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #32 0x601bf5e083a0 in rb_main /media/test/ruby/build/../main.c:42:12 #33 0x601bf5e083a0 in main /media/test/ruby/build/../main.c:62:12 #34 0x71c87a629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 previously allocated by thread T0 here: #0 0x601bf5dcaf8f in malloc (/media/test/ruby/build/ruby+0x1e2f8f) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) #1 0x601bf5e6cde5 in rb_gc_impl_malloc /media/test/ruby/build/../gc/default/default.c:8240:5 #2 0x601bf5e4ac51 in ruby_xmalloc2_body /media/test/ruby/build/../gc.c:4713:12 #3 0x601bf5e4ac51 in ruby_xmalloc2 /media/test/ruby/build/../gc.c:4707:34 #4 0x601bf61fae7f in ary_heap_alloc_buffer /media/test/ruby/build/../array.c:351:12 #5 0x601bf61fae7f in ary_resize_capa /media/test/ruby/build/../array.c:404:26 #6 0x601bf61fa51b in ary_double_capa /media/test/ruby/build/../array.c:461:5 #7 0x601bf61fa51b in ary_ensure_room_for_push /media/test/ruby/build/../array.c:620:9 #8 0x601bf6208ba7 in rb_ary_cat /media/test/ruby/build/../array.c:1399:24 #9 0x601bf6208ba7 in rb_ary_push_m /media/test/ruby/build/../array.c:1426:12 #10 0x601bf6193b3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #11 0x601bf617c4e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #12 0x601bf617bfd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #13 0x601bf61421d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #14 0x601bf61421d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #15 0x601bf613aa47 in rb_vm_exec /media/test/ruby/build/../vm.c #16 0x601bf5e0cce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #17 0x601bf5e0cce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #18 0x601bf5e083a0 in rb_main /media/test/ruby/build/../main.c:42:12 #19 0x601bf5e083a0 in main /media/test/ruby/build/../main.c:62:12 #20 0x71c87a629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-use-after-free /media/test/ruby/build/../array.c:5334:21 in rb_ary_hash_values Shadow bytes around the buggy address: 0x511000009a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x511000009a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x511000009b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x511000009b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x511000009c00: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa =>0x511000009c80: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x511000009d00: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x511000009d80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x511000009e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x511000009e80: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa 0x511000009f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==105169==ABORTING ../triaged/array_hash.rb:12: [BUG] ASAN error ruby 3.5.0dev (2025-05-02T21:28:25Z master 36c64b3be8) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:0003 p:---- s:0011 e:000010 CFUNC :hash c:0002 p:0044 s:0007 E:000e48 EVAL ../triaged/array_hash.rb:12 [FINISH] c:0001 p:0000 s:0003 E:000540 DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- ../triaged/array_hash.rb:12:in '<main>' ../triaged/array_hash.rb:12:in 'hash' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- ./ruby(___interceptor_backtrace) [0x601bf5d75006] /media/test/ruby/build/ruby(rb_print_backtrace+0x14) [0x601bf64c3337] /media/test/ruby/build/../vm_dump.c:839 /media/test/ruby/build/ruby(rb_vm_bugreport) /media/test/ruby/build/../vm_dump.c:1171 /media/test/ruby/build/ruby(rb_bug_without_die_internal+0x23c) [0x601bf641776c] /media/test/ruby/build/../error.c:1097 /media/test/ruby/build/ruby(rb_bug_without_die+0x127) [0x601bf6417487] /media/test/ruby/build/../error.c:1106 ./ruby(0x601bf5deebc6) [0x601bf5deebc6] ./ruby(0x601bf5dcfc9f) [0x601bf5dcfc9f] ./ruby(0x601bf5dd2ce5) [0x601bf5dd2ce5] ./ruby(__asan_report_load8) [0x601bf5dd3988] /media/test/ruby/build/ruby(rb_ary_hash_values+0xcb) [0x601bf620302b] /media/test/ruby/build/../array.c:5334 /media/test/ruby/build/ruby(vm_cfp_consistent_p+0x0) [0x601bf6193b3c] ../vm_insnhelper.c:3797 /media/test/ruby/build/ruby(vm_call_cfunc_with_frame_) ../vm_insnhelper.c:3799 /media/test/ruby/build/ruby(vm_call_method_each_type+0x264) [0x601bf617c4e4] ../vm_insnhelper.c:4775 ./ruby(vm_call_method+0x2d4) [0x601bf617bfd4] /media/test/ruby/build/ruby(vm_sendish+0x1c8) [0x601bf61421d9] ../vm_insnhelper.c:5972 /media/test/ruby/build/ruby(vm_exec_core) ../insns.def:899 ./ruby(vm_exec_loop+0x0) [0x601bf613aa48] /media/test/ruby/build/ruby(rb_vm_exec) /media/test/ruby/build/../vm.c:2621 /media/test/ruby/build/ruby(rb_ec_exec_node+0x53) [0x601bf5e0cce1] /media/test/ruby/build/../eval.c:281 /media/test/ruby/build/ruby(ruby_run_node) /media/test/ruby/build/../eval.c:319 /media/test/ruby/build/ruby(rb_main+0x29) [0x601bf5e083a1] /media/test/ruby/build/../main.c:42 /media/test/ruby/build/ruby(main) /media/test/ruby/build/../main.c:62 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_call_main+0x80) [0x71c87a629d90] ../sysdeps/nptl/libc_start_call_main.h:58 /lib/x86_64-linux-gnu/libc.so.6(call_init+0x0) [0x71c87a629e40] ../csu/libc-start.c:392 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main_impl) ../csu/libc-start.c:379 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main) (null):0 ./ruby(_start) [0x601bf5d30d55] -- Other runtime information ----------------------------------------------- * Loaded script: ../triaged/array_hash.rb * Loaded features: 0 enumerator.so 1 thread.rb 2 fiber.so 3 rational.so 4 complex.so 5 ruby2_keywords.rb 6 set.rb ``` -- https://bugs.ruby-lang.org/

2 1

[ruby-core:121806] [Ruby Bug#21303] heap-buffer-overflow of Array#difference via mutating hash method
by cyruscyliu (Qiang Liu) 03 May '25

03 May '25

Issue #21303 has been reported by cyruscyliu (Qiang Liu). ---------------------------------------- Bug #21303: heap-buffer-overflow of Array#difference via mutating hash method https://bugs.ruby-lang.org/issues/21303 * Author: cyruscyliu (Qiang Liu) * Status: Open * ruby -v: ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- Hi, we found a heap-buffer-overflow of Array#difference via mutating hash method. Here is the PoC. ``` class C def hash $a.clear return 0 end def eql?(other) return true end end $b = (1..20).to_a $a = (1..10000).to_a $a.push(C.new) $a.difference($b, $b) ``` Specifically, calling Array#difference on an array with an object whose hash method mutates the array causes memory corruption. Here, C#hash clears $a while difference is iterating over it, breaking internal invariants and leading to a crash or invalid memory access. To reproduce, compile the recent Ruby with ASAN, and run the PoC. ``` $ ruby -v ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu] $ ruby array_difference.rb `RubyGems' were not loaded. `error_highlight' was not loaded. `did_you_mean' was not loaded. `syntax_suggest' was not loaded. ================================================================= ==88761==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51100001d500 at pc 0x598237a7f324 bp 0x7ffc9d9f0150 sp 0x7ffc9d9f0148 READ of size 8 at 0x51100001d500 thread T0 #0 0x598237a7f323 in RARRAY_AREF /media/test/ruby/build/../internal/array.h:147:11 #1 0x598237a7f323 in rb_ary_difference_multi /media/test/ruby/build/../array.c:5616:52 #2 0x598237a0ab3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #3 0x5982379f34e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #4 0x5982379f2fd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #5 0x5982379b91d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #6 0x5982379b91d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #7 0x5982379b1a47 in rb_vm_exec /media/test/ruby/build/../vm.c #8 0x598237683ce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #9 0x598237683ce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #10 0x59823767f3a0 in rb_main /media/test/ruby/build/../main.c:42:12 #11 0x59823767f3a0 in main /media/test/ruby/build/../main.c:62:12 #12 0x7f619c429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #13 0x7f619c429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #14 0x5982375a7d54 in _start (/media/test/ruby/build/ruby+0x148d54) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) Address 0x51100001d500 is a wild pointer inside of access range of size 0x000000000008. SUMMARY: AddressSanitizer: heap-buffer-overflow /media/test/ruby/build/../internal/array.h:147:11 in RARRAY_AREF Shadow bytes around the buggy address: 0x51100001d280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x51100001d500:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==88761==ABORTING ../triaged/array_difference.rb:16: [BUG] ASAN error ruby 3.5.0dev (2025-05-02T21:28:25Z master 36c64b3be8) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:0003 p:---- s:0012 e:000011 CFUNC :difference c:0002 p:0048 s:0006 e:000005 EVAL ../triaged/array_difference.rb:16 [FINISH] c:0001 p:0000 s:0003 E:000540 DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- ../triaged/array_difference.rb:16:in '<main>' ../triaged/array_difference.rb:16:in 'difference' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- ./ruby(___interceptor_backtrace) [0x5982375ec006] /media/test/ruby/build/ruby(rb_print_backtrace+0x14) [0x598237d3a337] /media/test/ruby/build/../vm_dump.c:839 /media/test/ruby/build/ruby(rb_vm_bugreport) /media/test/ruby/build/../vm_dump.c:1171 /media/test/ruby/build/ruby(rb_bug_without_die_internal+0x23c) [0x598237c8e76c] /media/test/ruby/build/../error.c:1097 /media/test/ruby/build/ruby(rb_bug_without_die+0x127) [0x598237c8e487] /media/test/ruby/build/../error.c:1106 ./ruby(0x598237665bc6) [0x598237665bc6] ./ruby(0x598237646c9f) [0x598237646c9f] ./ruby(0x598237649ce5) [0x598237649ce5] ./ruby(__asan_report_load8) [0x59823764a988] /media/test/ruby/build/ruby(rb_ary_difference_multi+0xb64) [0x598237a7f324] ../internal/array.h:147 /media/test/ruby/build/ruby(vm_cfp_consistent_p+0x0) [0x598237a0ab3c] ../vm_insnhelper.c:3797 /media/test/ruby/build/ruby(vm_call_cfunc_with_frame_) ../vm_insnhelper.c:3799 /media/test/ruby/build/ruby(vm_call_method_each_type+0x264) [0x5982379f34e4] ../vm_insnhelper.c:4775 ./ruby(vm_call_method+0x2d4) [0x5982379f2fd4] /media/test/ruby/build/ruby(vm_sendish+0x1c8) [0x5982379b91d9] ../vm_insnhelper.c:5972 /media/test/ruby/build/ruby(vm_exec_core) ../insns.def:899 ./ruby(vm_exec_loop+0x0) [0x5982379b1a48] /media/test/ruby/build/ruby(rb_vm_exec) /media/test/ruby/build/../vm.c:2621 /media/test/ruby/build/ruby(rb_ec_exec_node+0x53) [0x598237683ce1] /media/test/ruby/build/../eval.c:281 /media/test/ruby/build/ruby(ruby_run_node) /media/test/ruby/build/../eval.c:319 /media/test/ruby/build/ruby(rb_main+0x29) [0x59823767f3a1] /media/test/ruby/build/../main.c:42 /media/test/ruby/build/ruby(main) /media/test/ruby/build/../main.c:62 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_call_main+0x80) [0x7f619c429d90] ../sysdeps/nptl/libc_start_call_main.h:58 /lib/x86_64-linux-gnu/libc.so.6(call_init+0x0) [0x7f619c429e40] ../csu/libc-start.c:392 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main_impl) ../csu/libc-start.c:379 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main) (null):0 ./ruby(_start) [0x5982375a7d55] -- Other runtime information ----------------------------------------------- * Loaded script: ../triaged/array_difference.rb * Loaded features: 0 enumerator.so 1 thread.rb 2 fiber.so 3 rational.so 4 complex.so 5 ruby2_keywords.rb 6 set.rb ``` -- https://bugs.ruby-lang.org/

2 1