Issue #22410 has been reported by 0599jiangyc@gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22410: `IO#external_encoding` / `IO#internal_encoding` segfault on an uninitialized IO https://bugs.ruby-lang.org/issues/22410 * Author: 0599jiangyc@gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following code: ```ruby IO.allocate.external_encoding ``` (also `IO.allocate.internal_encoding`, or any `IO`/`File` subclass whose `initialize` does not call `super`, e.g. `class A < IO; def initialize(*) = nil; end; A.new.external_encoding`; `Marshal.dump` of such an object reaches the same code via `encoding_name`.) Resulted in this output: ``` io_min.rb:1: [BUG] Segmentation fault at 0x0000000000000068 ruby 4.1.0dev (2026-10-07) +PRISM [x86_64-linux] -- Ruby level backtrace information ---------------------------------------- io_min.rb:1:in '<main>' io_min.rb:1:in 'external_encoding' -- C level backtrace information ------------------------------------------- (rb_bug_for_fatal_signal+0x3b8) error.c:1183 (sigsegv+0x97) signal.c:982 libc.so.6 (rb_io_external_encoding+0x8d) io.c:13775 (vm_call_cfunc_with_frame_+0x27b) ../vm_insnhelper.c:3906 (vm_call_method_each_type+0x24a) ../vm_insnhelper.c:4898 (vm_call_method+0x39f) (vm_exec_core+0x113bc) ../vm_insnhelper.c:6285 (rb_vm_exec+0x242) vm.c:2909 (rb_ec_exec_node+0x56) eval.c:300 (ruby_run_node) eval.c:338 ``` `rb_io_external_encoding` and `rb_io_internal_encoding` read `RFILE(rb_io_taint_check(io))->fptr` and dereference it without `rb_io_check_initialized`/`GetOpenFile`, so `fptr == NULL` crashes. Other IO methods raise `IOError (uninitialized stream)` here. Also reproduces on a plain release build (Ubuntu's ruby 3.2.3). To reproduce: ``` ruby ./min.rb ``` Commit: ``` 3296d5c99ce005e4698fb27a405e01d766ad2647 (2026-09-15); also reproduced on master 9ce0df671980d669cbab8afc48124c7453897533 (2026-10-07) ``` Build configuration: ``` ../configure --disable-install-doc CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1" debugflags="-g" ``` Operating System: ``` Ubuntu 24.04.4 LTS (x86_64), clang 18.1.3 ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/