[ruby-core:126070] [Ruby Bug#22193] Segmentation fault in functions to MemoryView contiguity with NULL shape and/or strides
Issue #22193 has been reported by KitaitiMakoto (真 北市). ---------------------------------------- Bug #22193: Segmentation fault in functions to MemoryView contiguity with NULL shape and/or strides https://bugs.ruby-lang.org/issues/22193 * Author: KitaitiMakoto (真 北市) * Status: Open * ruby -v: ruby 4.1.0dev (2026-07-13T13:26:16Z origin/master cb2ea293c6) +PRISM [arm64-darwin25] * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hello, I encountered a segmentation fault when calling `rb_memory_view_is_row_major_contiguous` with a MemoryView whose shape and strides are `NULL`. For instance, a MemoryView initialized with `rb_memory_view_init_as_byte_array` function causes this problem. The cause is that the function handles `shape` and `strides` as arrays without checking whether they are `NULL` or not. Environment ----------- * Ruby commit: cb2ea293c6 * OS: macOS (M2 Mac) Code to reproduce the problem: ------------------------------ I will send a pull request later for the full patch. ### ext/-test-/memory_view/memory_view.c ### ```c static VALUE memory_view_is_row_major_contiguous(VALUE mod, VALUE obj) { rb_memory_view_t view; VALUE result; if (!rb_memory_view_get(obj, &view, 0)) { rb_raise(rb_eArgError, "Unable to get MemoryView"); } result = rb_memory_view_is_row_major_contiguous(&view) ? Qtrue : Qfalse; rb_memory_view_release(&view); return result; } static VALUE memory_view_is_column_major_contiguous(VALUE mod, VALUE obj) { rb_memory_view_t view; VALUE result; if (!rb_memory_view_get(obj, &view, 0)) { rb_raise(rb_eArgError, "Unable to get MemoryView"); } result = rb_memory_view_is_column_major_contiguous(&view) ? Qtrue : Qfalse; rb_memory_view_release(&view); return result; } // ... void Init_memory_view(void) { // ... rb_define_module_function(mMemoryViewTestUtils, "is_row_major_contiguous", memory_view_is_row_major_contiguous, 1); rb_define_module_function(mMemoryViewTestUtils, "is_column_major_contiguous", memory_view_is_column_major_contiguous, 1); // ... } ``` ### test/ruby/test_memory_view.rb ### ```ruby class TestMemoryView < Test::Unit::TestCase # ... def test_rb_memory_view_is_row_major_contiguous es = MemoryViewTestUtils::ExportableString.new("ruby") assert_true(MemoryViewTestUtils.is_row_major_contiguous(es)) end def test_rb_memory_view_is_column_major_contiguous es = MemoryViewTestUtils::ExportableString.new("ruby") assert_true(MemoryViewTestUtils.is_column_major_contiguous(es)) end # ... end ``` Steps to reproduce the problem: ------------------------------- 1. Add code above to the current Ruby (cb2ea293c6) 2. Run `make test-all TESTS=test/ruby/test_memory_view.rb` 3. Then you can see segmentation fault Thank you. -- https://bugs.ruby-lang.org/
Issue #22193 has been updated by KitaitiMakoto (真 北市). I sent a pull request to reproduce and fix the problem: https://github.com/ruby/ruby/pull/17851 ---------------------------------------- Bug #22193: Segmentation fault in functions to MemoryView contiguity with NULL shape and/or strides https://bugs.ruby-lang.org/issues/22193#change-118070 * Author: KitaitiMakoto (真 北市) * Status: Open * ruby -v: ruby 4.1.0dev (2026-07-13T13:26:16Z origin/master cb2ea293c6) +PRISM [arm64-darwin25] * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hello, I encountered a segmentation fault when calling `rb_memory_view_is_row_major_contiguous` with a MemoryView whose shape and strides are `NULL`. For instance, a MemoryView initialized with `rb_memory_view_init_as_byte_array` function causes this problem. The cause is that the function handles `shape` and `strides` as arrays without checking whether they are `NULL` or not. Environment ----------- * Ruby commit: cb2ea293c6 * OS: macOS (M2 Mac) Code to reproduce the problem: ------------------------------ I will send a pull request later for the full patch. ### ext/-test-/memory_view/memory_view.c ### ```c static VALUE memory_view_is_row_major_contiguous(VALUE mod, VALUE obj) { rb_memory_view_t view; VALUE result; if (!rb_memory_view_get(obj, &view, 0)) { rb_raise(rb_eArgError, "Unable to get MemoryView"); } result = rb_memory_view_is_row_major_contiguous(&view) ? Qtrue : Qfalse; rb_memory_view_release(&view); return result; } static VALUE memory_view_is_column_major_contiguous(VALUE mod, VALUE obj) { rb_memory_view_t view; VALUE result; if (!rb_memory_view_get(obj, &view, 0)) { rb_raise(rb_eArgError, "Unable to get MemoryView"); } result = rb_memory_view_is_column_major_contiguous(&view) ? Qtrue : Qfalse; rb_memory_view_release(&view); return result; } // ... void Init_memory_view(void) { // ... rb_define_module_function(mMemoryViewTestUtils, "is_row_major_contiguous", memory_view_is_row_major_contiguous, 1); rb_define_module_function(mMemoryViewTestUtils, "is_column_major_contiguous", memory_view_is_column_major_contiguous, 1); // ... } ``` ### test/ruby/test_memory_view.rb ### ```ruby class TestMemoryView < Test::Unit::TestCase # ... def test_rb_memory_view_is_row_major_contiguous es = MemoryViewTestUtils::ExportableString.new("ruby") assert_true(MemoryViewTestUtils.is_row_major_contiguous(es)) end def test_rb_memory_view_is_column_major_contiguous es = MemoryViewTestUtils::ExportableString.new("ruby") assert_true(MemoryViewTestUtils.is_column_major_contiguous(es)) end # ... end ``` Steps to reproduce the problem: ------------------------------- 1. Add code above to the current Ruby (cb2ea293c6) 2. Run `make test-all TESTS=test/ruby/test_memory_view.rb` 3. Then you can see segmentation fault Thank you. -- https://bugs.ruby-lang.org/
Issue #22193 has been updated by KitaitiMakoto (真 北市). I would appreciate it if this fix were backported to the next releases because I'm writing code that calls these functions: https://github.com/ruby-gnome/ruby-gnome/blob/f54e6598064b83e9ed118b84de07ca... ```c /* * When Ruby < 4.1.0, rb_memory_view_is_row_major_contiguous() and * rb_memory_view_is_column_major_contiguous() have a bug and * rg_gst_audio_audio_info_from_memory_view() crashes. */ #if RUBY_API_VERSION_CODE < 40100 *err = "not implemented when Ruby < 4.1.0"; return false; #endif ``` I want to loosen the restriction above to Ruby < 4.0.7 and the same for 3.x.x. Thank you. ---------------------------------------- Bug #22193: Segmentation fault in functions to check MemoryView contiguity with NULL shape and/or strides https://bugs.ruby-lang.org/issues/22193#change-118447 * Author: KitaitiMakoto (真 北市) * Status: Closed * ruby -v: ruby 4.1.0dev (2026-07-13T13:26:16Z origin/master cb2ea293c6) +PRISM [arm64-darwin25] * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hello, I encountered a segmentation fault when calling `rb_memory_view_is_row_major_contiguous` with a MemoryView whose shape and strides are `NULL`. For instance, a MemoryView initialized with `rb_memory_view_init_as_byte_array` function causes this problem. The cause is that the function handles `shape` and `strides` as arrays without checking whether they are `NULL` or not. Environment ----------- * Ruby commit: cb2ea293c6 * OS: macOS (M2 Mac) Code to reproduce the problem: ------------------------------ I will send a pull request later for the full patch. ### ext/-test-/memory_view/memory_view.c ### ```c static VALUE memory_view_is_row_major_contiguous(VALUE mod, VALUE obj) { rb_memory_view_t view; VALUE result; if (!rb_memory_view_get(obj, &view, 0)) { rb_raise(rb_eArgError, "Unable to get MemoryView"); } result = rb_memory_view_is_row_major_contiguous(&view) ? Qtrue : Qfalse; rb_memory_view_release(&view); return result; } static VALUE memory_view_is_column_major_contiguous(VALUE mod, VALUE obj) { rb_memory_view_t view; VALUE result; if (!rb_memory_view_get(obj, &view, 0)) { rb_raise(rb_eArgError, "Unable to get MemoryView"); } result = rb_memory_view_is_column_major_contiguous(&view) ? Qtrue : Qfalse; rb_memory_view_release(&view); return result; } // ... void Init_memory_view(void) { // ... rb_define_module_function(mMemoryViewTestUtils, "is_row_major_contiguous", memory_view_is_row_major_contiguous, 1); rb_define_module_function(mMemoryViewTestUtils, "is_column_major_contiguous", memory_view_is_column_major_contiguous, 1); // ... } ``` ### test/ruby/test_memory_view.rb ### ```ruby class TestMemoryView < Test::Unit::TestCase # ... def test_rb_memory_view_is_row_major_contiguous es = MemoryViewTestUtils::ExportableString.new("ruby") assert_true(MemoryViewTestUtils.is_row_major_contiguous(es)) end def test_rb_memory_view_is_column_major_contiguous es = MemoryViewTestUtils::ExportableString.new("ruby") assert_true(MemoryViewTestUtils.is_column_major_contiguous(es)) end # ... end ``` Steps to reproduce the problem: ------------------------------- 1. Add code above to the current Ruby (cb2ea293c6) 2. Run `make test-all TESTS=test/ruby/test_memory_view.rb` 3. Then you can see segmentation fault Thank you. -- https://bugs.ruby-lang.org/
participants (1)
-
KitaitiMakoto