Issue #21303 has been reported by cyruscyliu (Qiang Liu). ---------------------------------------- Bug #21303: heap-buffer-overflow of Array#difference via mutating hash method https://bugs.ruby-lang.org/issues/21303 * Author: cyruscyliu (Qiang Liu) * Status: Open * ruby -v: ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- Hi, we found a heap-buffer-overflow of Array#difference via mutating hash method. Here is the PoC. ``` class C def hash $a.clear return 0 end def eql?(other) return true end end $b = (1..20).to_a $a = (1..10000).to_a $a.push(C.new) $a.difference($b, $b) ``` Specifically, calling Array#difference on an array with an object whose hash method mutates the array causes memory corruption. Here, C#hash clears $a while difference is iterating over it, breaking internal invariants and leading to a crash or invalid memory access. To reproduce, compile the recent Ruby with ASAN, and run the PoC. ``` $ ruby -v ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu] $ ruby array_difference.rb `RubyGems' were not loaded. `error_highlight' was not loaded. `did_you_mean' was not loaded. `syntax_suggest' was not loaded. ================================================================= ==88761==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51100001d500 at pc 0x598237a7f324 bp 0x7ffc9d9f0150 sp 0x7ffc9d9f0148 READ of size 8 at 0x51100001d500 thread T0 #0 0x598237a7f323 in RARRAY_AREF /media/test/ruby/build/../internal/array.h:147:11 #1 0x598237a7f323 in rb_ary_difference_multi /media/test/ruby/build/../array.c:5616:52 #2 0x598237a0ab3b in vm_call_cfunc_with_frame_ /media/test/ruby/build/../vm_insnhelper.c:3797:11 #3 0x5982379f34e3 in vm_call_method_each_type /media/test/ruby/build/../vm_insnhelper.c:4775:16 #4 0x5982379f2fd3 in vm_call_method /media/test/ruby/build/../vm_insnhelper.c #5 0x5982379b91d8 in vm_sendish /media/test/ruby/build/../vm_insnhelper.c:5972:15 #6 0x5982379b91d8 in vm_exec_core /media/test/ruby/build/../insns.def:899:11 #7 0x5982379b1a47 in rb_vm_exec /media/test/ruby/build/../vm.c #8 0x598237683ce0 in rb_ec_exec_node /media/test/ruby/build/../eval.c:281:9 #9 0x598237683ce0 in ruby_run_node /media/test/ruby/build/../eval.c:319:30 #10 0x59823767f3a0 in rb_main /media/test/ruby/build/../main.c:42:12 #11 0x59823767f3a0 in main /media/test/ruby/build/../main.c:62:12 #12 0x7f619c429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #13 0x7f619c429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #14 0x5982375a7d54 in _start (/media/test/ruby/build/ruby+0x148d54) (BuildId: 58c97094e0527fad484552e230da980d80ffa516) Address 0x51100001d500 is a wild pointer inside of access range of size 0x000000000008. SUMMARY: AddressSanitizer: heap-buffer-overflow /media/test/ruby/build/../internal/array.h:147:11 in RARRAY_AREF Shadow bytes around the buggy address: 0x51100001d280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x51100001d500:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51100001d780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==88761==ABORTING ../triaged/array_difference.rb:16: [BUG] ASAN error ruby 3.5.0dev (2025-05-02T21:28:25Z master 36c64b3be8) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:0003 p:---- s:0012 e:000011 CFUNC :difference c:0002 p:0048 s:0006 e:000005 EVAL ../triaged/array_difference.rb:16 [FINISH] c:0001 p:0000 s:0003 E:000540 DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- ../triaged/array_difference.rb:16:in '<main>' ../triaged/array_difference.rb:16:in 'difference' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- ./ruby(___interceptor_backtrace) [0x5982375ec006] /media/test/ruby/build/ruby(rb_print_backtrace+0x14) [0x598237d3a337] /media/test/ruby/build/../vm_dump.c:839 /media/test/ruby/build/ruby(rb_vm_bugreport) /media/test/ruby/build/../vm_dump.c:1171 /media/test/ruby/build/ruby(rb_bug_without_die_internal+0x23c) [0x598237c8e76c] /media/test/ruby/build/../error.c:1097 /media/test/ruby/build/ruby(rb_bug_without_die+0x127) [0x598237c8e487] /media/test/ruby/build/../error.c:1106 ./ruby(0x598237665bc6) [0x598237665bc6] ./ruby(0x598237646c9f) [0x598237646c9f] ./ruby(0x598237649ce5) [0x598237649ce5] ./ruby(__asan_report_load8) [0x59823764a988] /media/test/ruby/build/ruby(rb_ary_difference_multi+0xb64) [0x598237a7f324] ../internal/array.h:147 /media/test/ruby/build/ruby(vm_cfp_consistent_p+0x0) [0x598237a0ab3c] ../vm_insnhelper.c:3797 /media/test/ruby/build/ruby(vm_call_cfunc_with_frame_) ../vm_insnhelper.c:3799 /media/test/ruby/build/ruby(vm_call_method_each_type+0x264) [0x5982379f34e4] ../vm_insnhelper.c:4775 ./ruby(vm_call_method+0x2d4) [0x5982379f2fd4] /media/test/ruby/build/ruby(vm_sendish+0x1c8) [0x5982379b91d9] ../vm_insnhelper.c:5972 /media/test/ruby/build/ruby(vm_exec_core) ../insns.def:899 ./ruby(vm_exec_loop+0x0) [0x5982379b1a48] /media/test/ruby/build/ruby(rb_vm_exec) /media/test/ruby/build/../vm.c:2621 /media/test/ruby/build/ruby(rb_ec_exec_node+0x53) [0x598237683ce1] /media/test/ruby/build/../eval.c:281 /media/test/ruby/build/ruby(ruby_run_node) /media/test/ruby/build/../eval.c:319 /media/test/ruby/build/ruby(rb_main+0x29) [0x59823767f3a1] /media/test/ruby/build/../main.c:42 /media/test/ruby/build/ruby(main) /media/test/ruby/build/../main.c:62 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_call_main+0x80) [0x7f619c429d90] ../sysdeps/nptl/libc_start_call_main.h:58 /lib/x86_64-linux-gnu/libc.so.6(call_init+0x0) [0x7f619c429e40] ../csu/libc-start.c:392 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main_impl) ../csu/libc-start.c:379 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main) (null):0 ./ruby(_start) [0x5982375a7d55] -- Other runtime information ----------------------------------------------- * Loaded script: ../triaged/array_difference.rb * Loaded features: 0 enumerator.so 1 thread.rb 2 fiber.so 3 rational.so 4 complex.so 5 ruby2_keywords.rb 6 set.rb ``` -- https://bugs.ruby-lang.org/