September 2026 - ruby-core - ml.ruby-lang.org

[ruby-core:126782] [Ruby Bug#22336] IO:Buffer Heap uaf
by danielchong (Daniel Chong) 20 Sep '26

20 Sep '26

Issue #22336 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22336: IO:Buffer Heap uaf https://bugs.ruby-lang.org/issues/22336 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hello, a UAF is possible in IO:Buffer. PoC: ``` $buf = IO::Buffer.new(64) evil = Object.new def evil.to_str $buf.resize(64 * 1024 * 1024) "UTF-8" end $buf.get_string(0, 32, evil) ``` ASAN (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free ... READ of size 32 #3 str_enc_new string.c:1109 #4 io_buffer_get_string io_buffer.c:3276 <- USE (read from stale base) freed by thread T0 here: #0 realloc #1 rb_io_buffer_resize io_buffer.c:2203 <- FREE (realloc move) #2 io_buffer_resize io_buffer.c:2249 ... #16 rb_str_to_str string.c:1818 #18 name_for_encoding encoding.c:296 #20 rb_find_encoding encoding.c:345 #21 io_buffer_get_string io_buffer.c:3266 <- reentrancy boundary (encoding to_str) previously allocated by thread T0 here: #0 calloc #1 io_buffer_initialize io_buffer.c:216 <- original 64-byte INTERNAL buffer ``` -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126770] [Ruby Bug#22334] Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)
by 0599jiangyc＠gmail.com (Yuancheng Jiang) 20 Sep '26

20 Sep '26

Issue #22334 has been reported by 0599jiangyc(a)gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) https://bugs.ruby-lang.org/issues/22334 * Author: 0599jiangyc(a)gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following code: ```ruby def r; return **[nil]; end; r() ``` Resulted in this output: ``` ../vm_core.h:1554: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- ../vm_core.h:1554: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) +PRISM [x86_64-linux] Crashed while printing bug report Aborted (core dumped) ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126738] [Ruby Bug#22322] AddressSanitizer: use-after-poison in econv_description /ruby-src/build/../transcode.c
by 0599jiangyc＠gmail.com (Yuancheng Jiang) 20 Sep '26

20 Sep '26

Issue #22322 has been reported by 0599jiangyc(a)gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22322: AddressSanitizer: use-after-poison in econv_description /ruby-src/build/../transcode.c https://bugs.ruby-lang.org/issues/22322 * Author: 0599jiangyc(a)gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following program: ```ruby ec = Encoding::Converter.new("", "xml_attr_content_escape") begin ec.dup.freeze; ec.clone(freeze: false); GC.start(full_mark: true, immediate_sweep: true); ObjectSpace.each_object(ec.class).first(50).each(&:inspect); rescue Exception; end # dataflow fusion ``` makes the interpreter report: ``` ================================================================= ==1596291==ERROR: AddressSanitizer: use-after-poison on address 0x79ce1cfff1f8 at pc 0x60e57424f1e5 bp 0x7ffd8f1a9020 sp 0x7ffd8f1a9018 READ of size 1 at 0x79ce1cfff1f8 thread T0 #0 0x60e57424f1e4 in econv_description /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../transcode.c:2069:9 #1 0x60e574254cfd in econv_inspect /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../transcode.c:3572:9 #2 0x60e57430c9b9 in vm_call0_cfunc_with_frame /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:164:15 #3 0x60e57430c9b9 in vm_call0_cfunc /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:178:12 #4 0x60e57430c9b9 in vm_call0_body /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:229:15 #5 0x60e57430f704 in vm_call0_cc /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:101:12 #6 0x60e57430f704 in rb_call0 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:577:12 #7 0x60e5742c0b7c in rb_call /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:896:12 #8 0x60e5742c0b7c in rb_funcall_with_block_kw /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:1216:12 #9 0x60e574313e8e in vm_yield_with_symbol /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:5291:16 #10 0x60e5743134e1 in invoke_block_from_c_bh /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1912:16 #11 0x60e5742c10b3 in vm_yield_with_cref /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1946:12 #12 0x60e5742c10b3 in vm_yield /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1954:12 #13 0x60e5742c10b3 in rb_ec_yield /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c #14 0x60e57437fa35 in rb_ary_each /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:2792:9 #15 0x60e5742f720a in vm_call_cfunc_with_frame_ /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:3904:11 #16 0x60e5742e14b9 in vm_call_method_each_type /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:4896:16 #17 0x60e5742e0c4e in vm_call_method /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c #18 0x60e5742a59ea in vm_sendish /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:6283:15 #19 0x60e5742a59ea in vm_exec_core /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../insns.def:864:11 #20 0x60e57428dbe1 in rb_vm_exec /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:2881:22 #21 0x60e573ee5c1c in rb_ec_exec_node /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../eval.c:299:9 #22 0x60e573ee5c1c in ruby_r ``` To reproduce: ``` /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb ``` Commit: ``` 3296d5c99ce005e4698fb27a405e01d766ad2647 ``` Build configuration: ``` ../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1" ``` Operating System: ``` Ubuntu 24.04 host, Docker ffe-ruby:latest ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126731] [Ruby Bug#22319] heap buffer overflow triggered by array's zip function
by danielchong (Daniel Chong) 20 Sep '26

20 Sep '26

Issue #22319 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22319: heap buffer overflow triggered by array's zip function https://bugs.ruby-lang.org/issues/22319 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 RARRAY_AREF internal/array.h:153 #1 rb_ary_zip array.c:4850 <-- USE (stale len) 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via arg's to_ary) ... #18 convert_type_with_id object.c:3303 <-- take_items -> to_ary -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126730] [Ruby Bug#22318] heap uaf triggered in array.flatten
by danielchong (Daniel Chong) 20 Sep '26

20 Sep '26

Issue #22318 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22318: heap uaf triggered in array.flatten https://bugs.ruby-lang.org/issues/22318 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hello, there seems to be a bug in Array's flatten function. PoC: ``` a = (1..2000).to_a bad = Object.new $a = a def bad.to_ary; $a.clear; [1,2,3]; end a << bad a.flatten ``` ASAN output (truncated): ``` 7==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 16000 ... thread T0 #3 ary_memcpy0 array.c:354 #4 ary_memcpy array.c:371 #5 flatten array.c:6715 <-- USE (stale count i) #6 rb_ary_flatten array.c:6924 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via to_ary) ... #18 convert_type_with_id object.c:3303 #21 rb_check_array_type array.c:1032 #22 flatten array.c:6705 <-- reentrant conversion ``` -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126719] [Ruby Bug#22315] heap-use-after-free in String unpack with a block that mutates the receiver
by danielchong (Daniel Chong) 20 Sep '26

20 Sep '26

Issue #22315 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22315: heap-use-after-free in String unpack with a block that mutates the receiver https://bugs.ruby-lang.org/issues/22315 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- PoC: s = "C" * 4000 s.unpack("L*") { s.clear } Asan (truncated): ERROR: AddressSanitizer: heap-use-after-free on address 0x... READ of size 4 ... thread T0 #3 bary_unpack_internal bignum.c:1179 #4 rb_integer_unpack bignum.c:3753 #5 pack_unpack_internal pack.c:1415 <-- USE 0x... is located 4 bytes inside of 4001-byte region [...] freed by thread T0 here: #2 ruby_xfree_sized gc.c:6295 #3 str_discard string.c:2840 #4 rb_str_clear string.c:6678 ... #16 rb_yield vm_eval.c #17 pack_unpack_internal pack.c:1416 <-- FREE (user block via rb_yield) -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126648] [Ruby Bug#22303] EncodingError from interpolating symbol crashes whole process
by alanwu (Alan Wu) 20 Sep '26

20 Sep '26

Issue #22303 has been reported by alanwu (Alan Wu). ---------------------------------------- Bug #22303: EncodingError from interpolating symbol crashes whole process https://bugs.ruby-lang.org/issues/22303 * Author: alanwu (Alan Wu) * Status: Closed * Backport: 3.3: UNKNOWN, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- commit:5831948a66412922e1abafd2c38fd6400e420581 The `intern` instruction has been incorrectly marked true for a long time (3.3 through trunk) and its stack canary check crashes the whole runtime process. The crash only happens in debug builds. (`VM_CHECK_MODE > 0`) In release builds it can give the wrong line number in backtrace, if running in the interpreter, or when running in the JIT cause GC safety issues. -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126737] [Ruby Bug#22321] Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE
by 0599jiangyc＠gmail.com (Yuancheng Jiang) 20 Sep '26

20 Sep '26

Issue #22321 has been reported by 0599jiangyc(a)gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22321: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE https://bugs.ruby-lang.org/issues/22321 * Author: 0599jiangyc(a)gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following program: ```ruby def assert_equal(*a) = nil bug15629_m1 = Module.new do def foo; end end bug15629_m2 = Module.new do def foo; end end bug15629_c = Class.new do include bug15629_m1 include bug15629_m2 end o = bug15629_c.new m = o.method(:foo) sm = m.super_method assert_equal(sm, m.unbind.bind(o).super_method) begin ObjectSpace.each_object(sm.class).first(50).each(&:inspect); GC.start(full_mark: true, immediate_sweep: true); Marshal.load(Marshal.dump(sm)); rescue Exception; end # dataflow fusion ``` makes the interpreter report: ``` ../vm_insnhelper.c:2264: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) [x86_64-linux] -- Control frame information ----------------------------------------------- c:0004 p:---- s:0019 e:000018 l:y b:0001 r:(nil) CFUNC :inspect c:0003 p:---- s:0016 e:000015 l:y b:0001 r:(nil) CFUNC :each c:0002 p:0087 s:0012 E:001198 l:n b:---- r:(nil) EVAL /tmp/test.rb:16 [FINISH] c:0001 p:0000 s:0003 E:001ed8 l:y b:---- r:(nil) DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- /tmp/test.rb:16:in '<main>' /tmp/test.rb:16:in 'each' /tmp/test.rb:16:in 'inspect' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(___interceptor_backtrace) [0x56e7d13b671a] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_print_backtrace+0x14) [0x56e7d18914ea] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1113 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_bugreport) /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1479 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x233) [0x56e7d1371b2b] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1258 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_search_method_slowpath+0x558) [0x56e7d17f1478] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_search_method_slowpath0+0x32) [0x56e7d17f2ca2] ../vm_insnhelper.c:2295 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(gccct_method_search_slowpath+0x4d) [0x56e7d184980d] ../vm_eval.c:419 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcallv_scope+0x1a4) [0x56e7d18280c4] ../vm_eval.c:1064 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_inspect+0x15) [0x56e7d15a2335] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../object.c:733 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(method_inspect+0x52b) [0x56e7d15c81ab] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../proc.c:4101 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call0_body+0x100a) [0x56e7d18759ba] ../vm_eval.c:164 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_call0+0x4c5) [0x56e7d1878705] ../vm_eval.c:101 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcall_with_block_kw+0x14d) [0x56e7d1829b7d] ../vm_eval.c:896 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_yield_with_symbol+0x1ff) [0x56e7d187ce8f] ../vm_insnhelper.c:5291 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/b ``` To reproduce: ``` /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb ``` Commit: ``` 3296d5c99ce005e4698fb27a405e01d766ad2647 ``` Build configuration: ``` ../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1" ``` Operating System: ``` Ubuntu 24.04 host, Docker ffe-ruby:latest ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126784] [Ruby Bug#22337] OOB write in array.pack()
by danielchong (Daniel Chong) 20 Sep '26

20 Sep '26

Issue #22337 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22337: OOB write in array.pack() https://bugs.ruby-lang.org/issues/22337 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hi, I found a case that causes an oob write in array.pack() PoC: ``` buf = "Z" * 4096 $buf = buf evil = Object.new def evil.to_int $buf.replace("q") 123456789 end [evil].pack("r", buffer: buf) ``` asan output (truncated): ``` ==ERROR: AddressSanitizer: use-after-poison ... WRITE of size 1 #0 bary_pack bignum.c:911 #1 rb_integer_pack bignum.c:3673 #2 pack_pack pack.c:800 <- write at RSTRING_PTR(res)+stale_start #3 vm_opt_newarray_pack_buffer vm_insnhelper.c:6632 Address ... is a wild pointer inside of access range of size 0x1. ``` -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126499] [Ruby Bug#22264] Warning missing from parse.y hash literals
by kddnewton (Kevin Newton) 20 Sep '26

20 Sep '26

Issue #22264 has been reported by kddnewton (Kevin Newton). ---------------------------------------- Bug #22264: Warning missing from parse.y hash literals https://bugs.ruby-lang.org/issues/22264 * Author: kddnewton (Kevin Newton) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- $ ruby --parser=parse.y -cve '{**{}, a: 1, **{a: 2}}' ruby 4.1.0dev (2026-04-21T02:07:14Z aot be86d5704f) [arm64-darwin23] Syntax OK $ ruby --parser=parse.y -cve '{a: 1, **{a: 2}}' ruby 4.1.0dev (2026-04-21T02:07:14Z aot be86d5704f) [arm64-darwin23] -e:1: warning: key :a is duplicated and overwritten on line 1 Syntax OK -- https://bugs.ruby-lang.org/

5 4