[ruby-core:126731] [Ruby Bug#22319] heap buffer overflow triggered by array's zip function
Issue #22319 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22319: heap buffer overflow triggered by array's zip function https://bugs.ruby-lang.org/issues/22319 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 RARRAY_AREF internal/array.h:153 #1 rb_ary_zip array.c:4850 <-- USE (stale len) 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via arg's to_ary) ... #18 convert_type_with_id object.c:3303 <-- take_items -> to_ary -- https://bugs.ruby-lang.org/
Issue #22319 has been updated by peterzhu2118 (Peter Zhu). Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED Thank you for reporting this bug. I have [a fix here](https://github.com/ruby/ruby/pull/18856) and have requested backports to Ruby 3.4 and 4.0. ---------------------------------------- Bug #22319: heap buffer overflow triggered by array's zip function https://bugs.ruby-lang.org/issues/22319#change-119031 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0dev * Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 RARRAY_AREF internal/array.h:153 #1 rb_ary_zip array.c:4850 <-- USE (stale len) 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via arg's to_ary) ... #18 convert_type_with_id object.c:3303 <-- take_items -> to_ary -- https://bugs.ruby-lang.org/
Issue #22319 has been updated by nagachika (Tomoyuki Chikanaga). Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ruby_3_4 commit:a03cc5f2c3d4918dc3cf2c75c181a1923b5d692f merged revision(s) commit:0c9f3f1e68e23a9ba2d7fdfdb86bd7ddcaf5e9d9. ---------------------------------------- Bug #22319: heap buffer overflow triggered by array's zip function https://bugs.ruby-lang.org/issues/22319#change-119105 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ---------------------------------------- Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 RARRAY_AREF internal/array.h:153 #1 rb_ary_zip array.c:4850 <-- USE (stale len) 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via arg's to_ary) ... #18 convert_type_with_id object.c:3303 <-- take_items -> to_ary -- https://bugs.ruby-lang.org/
Issue #22319 has been updated by nagachika (Tomoyuki Chikanaga). Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ruby_3_4 commit:2a77c0f6f9ee7752a3594455bac24812d8aeba9d merged revision(s) commit:0c9f3f1e68e23a9ba2d7fdfdb86bd7ddcaf5e9d9. ---------------------------------------- Bug #22319: heap buffer overflow triggered by array's zip function https://bugs.ruby-lang.org/issues/22319#change-119114 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ---------------------------------------- Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 RARRAY_AREF internal/array.h:153 #1 rb_ary_zip array.c:4850 <-- USE (stale len) 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via arg's to_ary) ... #18 convert_type_with_id object.c:3303 <-- take_items -> to_ary -- https://bugs.ruby-lang.org/
Issue #22319 has been updated by k0kubun (Takashi Kokubun). Backport changed from 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ruby_4_0 commit:4e9102bf35f6582c00ec10cdca1c87082be0f64e. ---------------------------------------- Bug #22319: heap buffer overflow triggered by array's zip function https://bugs.ruby-lang.org/issues/22319#change-119437 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ---------------------------------------- Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ... #0 RARRAY_AREF internal/array.h:153 #1 rb_ary_zip array.c:4850 <-- USE (stale len) 0x... is located 0 bytes after 256-byte region [...] allocated by thread T0 here: #4 ary_heap_realloc array.c:396 #5 ary_resize_capa array.c:439 #6 rb_ary_clear array.c:4988 <-- SHRINK (via arg's to_ary) ... #18 convert_type_with_id object.c:3303 <-- take_items -> to_ary -- https://bugs.ruby-lang.org/
participants (4)
-
danielchong (Daniel Chong) -
k0kubun (Takashi Kokubun)
-
nagachika (Tomoyuki Chikanaga)
-
peterzhu2118 (Peter Zhu)