Issue #22318 has been updated by nagachika (Tomoyuki Chikanaga). Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ruby_3_4 commit:2c409146fdce1eaf69dd3b8c403cd91390b72abc merged revision(s) commit:5eeaedc3d3014a12264aa252c751e14ba0fc5507. ---------------------------------------- Bug #22318: heap uaf triggered in array.flatten https://bugs.ruby-lang.org/issues/22318#change-119104 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ---------------------------------------- Hello, there seems to be a bug in Array's flatten function. PoC: ``` a = (1..2000).to_a bad = Object.new $a = a def bad.to_ary; $a.clear; [1,2,3]; end a << bad a.flatten ``` ASAN output (truncated): ``` 7==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 16000 ... thread T0 #3 ary_memcpy0 array.c:354 #4 ary_memcpy array.c:371 #5 flatten array.c:6715 <-- USE (stale count i) #6 rb_ary_flatten array.c:6924 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via to_ary) ... #18 convert_type_with_id object.c:3303 #21 rb_check_array_type array.c:1032 #22 flatten array.c:6705 <-- reentrant conversion ``` -- https://bugs.ruby-lang.org/