- ruby-core - ml.ruby-lang.org

[ruby-core:126770] [Ruby Bug#22334] Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)
by 0599jiangyc＠gmail.com (Yuancheng Jiang) 19 Sep '26

19 Sep '26

Issue #22334 has been reported by 0599jiangyc(a)gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) https://bugs.ruby-lang.org/issues/22334 * Author: 0599jiangyc(a)gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following code: ```ruby def r; return **[nil]; end; r() ``` Resulted in this output: ``` ../vm_core.h:1554: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- ../vm_core.h:1554: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) +PRISM [x86_64-linux] Crashed while printing bug report Aborted (core dumped) ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126738] [Ruby Bug#22322] AddressSanitizer: use-after-poison in econv_description /ruby-src/build/../transcode.c
by 0599jiangyc＠gmail.com (Yuancheng Jiang) 19 Sep '26

19 Sep '26

Issue #22322 has been reported by 0599jiangyc(a)gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22322: AddressSanitizer: use-after-poison in econv_description /ruby-src/build/../transcode.c https://bugs.ruby-lang.org/issues/22322 * Author: 0599jiangyc(a)gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following program: ```ruby ec = Encoding::Converter.new("", "xml_attr_content_escape") begin ec.dup.freeze; ec.clone(freeze: false); GC.start(full_mark: true, immediate_sweep: true); ObjectSpace.each_object(ec.class).first(50).each(&:inspect); rescue Exception; end # dataflow fusion ``` makes the interpreter report: ``` ================================================================= ==1596291==ERROR: AddressSanitizer: use-after-poison on address 0x79ce1cfff1f8 at pc 0x60e57424f1e5 bp 0x7ffd8f1a9020 sp 0x7ffd8f1a9018 READ of size 1 at 0x79ce1cfff1f8 thread T0 #0 0x60e57424f1e4 in econv_description /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../transcode.c:2069:9 #1 0x60e574254cfd in econv_inspect /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../transcode.c:3572:9 #2 0x60e57430c9b9 in vm_call0_cfunc_with_frame /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:164:15 #3 0x60e57430c9b9 in vm_call0_cfunc /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:178:12 #4 0x60e57430c9b9 in vm_call0_body /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:229:15 #5 0x60e57430f704 in vm_call0_cc /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:101:12 #6 0x60e57430f704 in rb_call0 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:577:12 #7 0x60e5742c0b7c in rb_call /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:896:12 #8 0x60e5742c0b7c in rb_funcall_with_block_kw /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c:1216:12 #9 0x60e574313e8e in vm_yield_with_symbol /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:5291:16 #10 0x60e5743134e1 in invoke_block_from_c_bh /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1912:16 #11 0x60e5742c10b3 in vm_yield_with_cref /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1946:12 #12 0x60e5742c10b3 in vm_yield /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:1954:12 #13 0x60e5742c10b3 in rb_ec_yield /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_eval.c #14 0x60e57437fa35 in rb_ary_each /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:2792:9 #15 0x60e5742f720a in vm_call_cfunc_with_frame_ /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:3904:11 #16 0x60e5742e14b9 in vm_call_method_each_type /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:4896:16 #17 0x60e5742e0c4e in vm_call_method /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c #18 0x60e5742a59ea in vm_sendish /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_insnhelper.c:6283:15 #19 0x60e5742a59ea in vm_exec_core /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../insns.def:864:11 #20 0x60e57428dbe1 in rb_vm_exec /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm.c:2881:22 #21 0x60e573ee5c1c in rb_ec_exec_node /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../eval.c:299:9 #22 0x60e573ee5c1c in ruby_r ``` To reproduce: ``` /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb ``` Commit: ``` 3296d5c99ce005e4698fb27a405e01d766ad2647 ``` Build configuration: ``` ../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1" ``` Operating System: ``` Ubuntu 24.04 host, Docker ffe-ruby:latest ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126731] [Ruby Bug#22319] heap buffer overflow triggered by array's zip function
by danielchong (Daniel Chong) 19 Sep '26

19 Sep '26

Issue #22319 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22319: heap buffer overflow triggered by array's zip function https://bugs.ruby-lang.org/issues/22319 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 RARRAY_AREF internal/array.h:153 #1 rb_ary_zip array.c:4850 <-- USE (stale len) 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via arg's to_ary) ... #18 convert_type_with_id object.c:3303 <-- take_items -> to_ary -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126730] [Ruby Bug#22318] heap uaf triggered in array.flatten
by danielchong (Daniel Chong) 19 Sep '26

19 Sep '26

Issue #22318 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22318: heap uaf triggered in array.flatten https://bugs.ruby-lang.org/issues/22318 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hello, there seems to be a bug in Array's flatten function. PoC: ``` a = (1..2000).to_a bad = Object.new $a = a def bad.to_ary; $a.clear; [1,2,3]; end a << bad a.flatten ``` ASAN output (truncated): ``` 7==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 16000 ... thread T0 #3 ary_memcpy0 array.c:354 #4 ary_memcpy array.c:371 #5 flatten array.c:6715 <-- USE (stale count i) #6 rb_ary_flatten array.c:6924 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via to_ary) ... #18 convert_type_with_id object.c:3303 #21 rb_check_array_type array.c:1032 #22 flatten array.c:6705 <-- reentrant conversion ``` -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126719] [Ruby Bug#22315] heap-use-after-free in String unpack with a block that mutates the receiver
by danielchong (Daniel Chong) 19 Sep '26

19 Sep '26

Issue #22315 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22315: heap-use-after-free in String unpack with a block that mutates the receiver https://bugs.ruby-lang.org/issues/22315 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- PoC: s = "C" * 4000 s.unpack("L*") { s.clear } Asan (truncated): ERROR: AddressSanitizer: heap-use-after-free on address 0x... READ of size 4 ... thread T0 #3 bary_unpack_internal bignum.c:1179 #4 rb_integer_unpack bignum.c:3753 #5 pack_unpack_internal pack.c:1415 <-- USE 0x... is located 4 bytes inside of 4001-byte region [...] freed by thread T0 here: #2 ruby_xfree_sized gc.c:6295 #3 str_discard string.c:2840 #4 rb_str_clear string.c:6678 ... #16 rb_yield vm_eval.c #17 pack_unpack_internal pack.c:1416 <-- FREE (user block via rb_yield) -- https://bugs.ruby-lang.org/

3 3

[ruby-core:126648] [Ruby Bug#22303] EncodingError from interpolating symbol crashes whole process
by alanwu (Alan Wu) 19 Sep '26

19 Sep '26

Issue #22303 has been reported by alanwu (Alan Wu). ---------------------------------------- Bug #22303: EncodingError from interpolating symbol crashes whole process https://bugs.ruby-lang.org/issues/22303 * Author: alanwu (Alan Wu) * Status: Closed * Backport: 3.3: UNKNOWN, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- commit:5831948a66412922e1abafd2c38fd6400e420581 The `intern` instruction has been incorrectly marked true for a long time (3.3 through trunk) and its stack canary check crashes the whole runtime process. The crash only happens in debug builds. (`VM_CHECK_MODE > 0`) In release builds it can give the wrong line number in backtrace, if running in the interpreter, or when running in the JIT cause GC safety issues. -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126737] [Ruby Bug#22321] Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE
by 0599jiangyc＠gmail.com (Yuancheng Jiang) 19 Sep '26

19 Sep '26

Issue #22321 has been reported by 0599jiangyc(a)gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22321: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE https://bugs.ruby-lang.org/issues/22321 * Author: 0599jiangyc(a)gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following program: ```ruby def assert_equal(*a) = nil bug15629_m1 = Module.new do def foo; end end bug15629_m2 = Module.new do def foo; end end bug15629_c = Class.new do include bug15629_m1 include bug15629_m2 end o = bug15629_c.new m = o.method(:foo) sm = m.super_method assert_equal(sm, m.unbind.bind(o).super_method) begin ObjectSpace.each_object(sm.class).first(50).each(&:inspect); GC.start(full_mark: true, immediate_sweep: true); Marshal.load(Marshal.dump(sm)); rescue Exception; end # dataflow fusion ``` makes the interpreter report: ``` ../vm_insnhelper.c:2264: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) [x86_64-linux] -- Control frame information ----------------------------------------------- c:0004 p:---- s:0019 e:000018 l:y b:0001 r:(nil) CFUNC :inspect c:0003 p:---- s:0016 e:000015 l:y b:0001 r:(nil) CFUNC :each c:0002 p:0087 s:0012 E:001198 l:n b:---- r:(nil) EVAL /tmp/test.rb:16 [FINISH] c:0001 p:0000 s:0003 E:001ed8 l:y b:---- r:(nil) DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- /tmp/test.rb:16:in '<main>' /tmp/test.rb:16:in 'each' /tmp/test.rb:16:in 'inspect' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(___interceptor_backtrace) [0x56e7d13b671a] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_print_backtrace+0x14) [0x56e7d18914ea] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1113 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_bugreport) /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1479 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x233) [0x56e7d1371b2b] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1258 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_search_method_slowpath+0x558) [0x56e7d17f1478] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_search_method_slowpath0+0x32) [0x56e7d17f2ca2] ../vm_insnhelper.c:2295 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(gccct_method_search_slowpath+0x4d) [0x56e7d184980d] ../vm_eval.c:419 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcallv_scope+0x1a4) [0x56e7d18280c4] ../vm_eval.c:1064 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_inspect+0x15) [0x56e7d15a2335] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../object.c:733 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(method_inspect+0x52b) [0x56e7d15c81ab] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../proc.c:4101 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call0_body+0x100a) [0x56e7d18759ba] ../vm_eval.c:164 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_call0+0x4c5) [0x56e7d1878705] ../vm_eval.c:101 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcall_with_block_kw+0x14d) [0x56e7d1829b7d] ../vm_eval.c:896 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_yield_with_symbol+0x1ff) [0x56e7d187ce8f] ../vm_insnhelper.c:5291 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/b ``` To reproduce: ``` /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb ``` Commit: ``` 3296d5c99ce005e4698fb27a405e01d766ad2647 ``` Build configuration: ``` ../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1" ``` Operating System: ``` Ubuntu 24.04 host, Docker ffe-ruby:latest ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126784] [Ruby Bug#22337] OOB write in array.pack()
by danielchong (Daniel Chong) 19 Sep '26

19 Sep '26

Issue #22337 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22337: OOB write in array.pack() https://bugs.ruby-lang.org/issues/22337 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hi, I found a case that causes an oob write in array.pack() PoC: ``` buf = "Z" * 4096 $buf = buf evil = Object.new def evil.to_int $buf.replace("q") 123456789 end [evil].pack("r", buffer: buf) ``` asan output (truncated): ``` ==ERROR: AddressSanitizer: use-after-poison ... WRITE of size 1 #0 bary_pack bignum.c:911 #1 rb_integer_pack bignum.c:3673 #2 pack_pack pack.c:800 <- write at RSTRING_PTR(res)+stale_start #3 vm_opt_newarray_pack_buffer vm_insnhelper.c:6632 Address ... is a wild pointer inside of access range of size 0x1. ``` -- https://bugs.ruby-lang.org/

3 2

[ruby-core:126499] [Ruby Bug#22264] Warning missing from parse.y hash literals
by kddnewton (Kevin Newton) 19 Sep '26

19 Sep '26

Issue #22264 has been reported by kddnewton (Kevin Newton). ---------------------------------------- Bug #22264: Warning missing from parse.y hash literals https://bugs.ruby-lang.org/issues/22264 * Author: kddnewton (Kevin Newton) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- $ ruby --parser=parse.y -cve '{**{}, a: 1, **{a: 2}}' ruby 4.1.0dev (2026-04-21T02:07:14Z aot be86d5704f) [arm64-darwin23] Syntax OK $ ruby --parser=parse.y -cve '{a: 1, **{a: 2}}' ruby 4.1.0dev (2026-04-21T02:07:14Z aot be86d5704f) [arm64-darwin23] -e:1: warning: key :a is duplicated and overwritten on line 1 Syntax OK -- https://bugs.ruby-lang.org/

5 4

[ruby-core:126480] [Ruby Bug#22259] Arrays sharding a buffer segfault when concatenating with each other
by chucke (Tiago Cardoso) 19 Sep '26

19 Sep '26

Issue #22259 has been reported by chucke (Tiago Cardoso). ---------------------------------------- Bug #22259: Arrays sharding a buffer segfault when concatenating with each other https://bugs.ruby-lang.org/issues/22259 * Author: chucke (Tiago Cardoso) * Status: Open * ruby -v: 4.0.6 * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- A succession of crashes was observed on a particular workload from our app, involving recursive set operations, after upgrading it to ruby 4.0.6 . LLM was used to build a reproduction (shared in the description of the PR linked below), after which we used it as a harness to get to the actual culprit and fix it. The crash is due to a particular behaviour of how (btw, TIL, so correct my explanation if necessary) ruby arrays share internal buffers, for optimal memory usage. `Array#dup` creates a separate array object, but may share (under certain conditions, i.e. does not embed) the internal C buffer, where objects are stored, with it. Certain modification operations, like `Array#dup`, don't forcefully "copy on write", and instead bump/dec an index on the shared buffer, as so to determine the slice of the original shared buffer it points to. The issue happens with how other operations work, such as `Array#concat`, which is, internally, under certain conditions, copying the full shared buffer to the destination array buffer, without regards of which slice it is about. This is easily demonstrable by the first reproduction in the PR linked below, where the last `concat` operation adds a "phantom" element to the destination array. that element is, at that point, gibberish, malloc-uninitialized data, which causes the VM to crash, depending on what it does with the address found there. This bug has been there for a while, and can be reproduced (with different faulty outcomes) since ruby 3.3 at least (didn't try further back). PR with fix here: https://github.com/ruby/ruby/pull/18472 -- https://bugs.ruby-lang.org/

5 6