Issue #22325 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22325: out of bounds read in array https://bugs.ruby-lang.org/issues/22325 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hi, an OOB read seems possible in array ``` class bad < Numeric def initialize(v); @v = v; end def val; @v; end def <=>(o); @v <=> (o.is_a?(bad) ? o.val : o); end def to_int; $a.clear; @v; end def to_i; @v; end def coerce(o); [o, @v]; end end $a = (1..3000).to_a seq = Range.new(bad.new(2900), bad.new(2950)).step(2) ``` asan output (truncated): ``` ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 ary_make_partial_step array.c:1303 #1 rb_ary_aref1 array.c:1947 #2 vm_opt_aref vm_insnhelper.c:7224 SUMMARY: AddressSanitizer: heap-buffer-overflow array.c:1303:9 in ary_make_partial_step ``` -- https://bugs.ruby-lang.org/