[ruby-core:126760] [Ruby Bug#22330] heap uaf from string.encode()
Issue #22330 has been reported by danielchong (Daniel Chong). ---------------------------------------- Bug #22330: heap uaf from string.encode() https://bugs.ruby-lang.org/issues/22330 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Hello, a heap UAF seems possible in string's encode function. PoC ``` s = "あ" * 4000 s.encode("US-ASCII", fallback: proc { |c| s.replace("Z" * (16 * 1024 * 1024)) "?" }) ``` ASAN output (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free ... READ of size 1 #0 transcode_restartable0 transcode.c:592:36 (*in_p) #1 transcode_restartable transcode.c:828 #2 rb_transcoding_convert transcode.c:864 #3 trans_sweep transcode.c:1191 #4 rb_trans_conv transcode.c:1281 #5 rb_econv_convert0 transcode.c:1400 #6 rb_econv_convert transcode.c:1508 #7 transcode_loop transcode.c:2417 (goto resume -> rb_econv_convert) #8 str_transcode0 transcode.c:2877 #9 str_transcode transcode.c:2907 #10 str_encode transcode.c:2973 freed by thread T0 here: #15 proc_fallback transcode.c:2340 (rb_proc_call -> user code reallocs source) #16 transcode_loop_fallback_try transcode.c:2366 #18 transcode_loop transcode.c:2433 ``` -- https://bugs.ruby-lang.org/
Issue #22330 has been updated by peterzhu2118 (Peter Zhu). Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED Thank you for the bug report, I have [a fix here](https://github.com/ruby/ruby/pull/18899). ---------------------------------------- Bug #22330: heap uaf from string.encode() https://bugs.ruby-lang.org/issues/22330#change-119061 * Author: danielchong (Daniel Chong) * Status: Open * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- Hello, a heap UAF seems possible in string's encode function. PoC ``` s = "あ" * 4000 s.encode("US-ASCII", fallback: proc { |c| s.replace("Z" * (16 * 1024 * 1024)) "?" }) ``` ASAN output (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free ... READ of size 1 #0 transcode_restartable0 transcode.c:592:36 (*in_p) #1 transcode_restartable transcode.c:828 #2 rb_transcoding_convert transcode.c:864 #3 trans_sweep transcode.c:1191 #4 rb_trans_conv transcode.c:1281 #5 rb_econv_convert0 transcode.c:1400 #6 rb_econv_convert transcode.c:1508 #7 transcode_loop transcode.c:2417 (goto resume -> rb_econv_convert) #8 str_transcode0 transcode.c:2877 #9 str_transcode transcode.c:2907 #10 str_encode transcode.c:2973 freed by thread T0 here: #15 proc_fallback transcode.c:2340 (rb_proc_call -> user code reallocs source) #16 transcode_loop_fallback_try transcode.c:2366 #18 transcode_loop transcode.c:2433 ``` -- https://bugs.ruby-lang.org/
Issue #22330 has been updated by nagachika (Tomoyuki Chikanaga). Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ruby_3_4 commit:75309143a8494abd682bdd23f3b18ecc2e48a2e4 merged revision(s) commit:cb302881629f997f403e705425f69e5f6b0741ac, commit:c914aeb622ce7337223cd5c23f30daf9f7d3e7c4. ---------------------------------------- Bug #22330: heap uaf from string.encode() https://bugs.ruby-lang.org/issues/22330#change-119181 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ---------------------------------------- Hello, a heap UAF seems possible in string's encode function. PoC ``` s = "あ" * 4000 s.encode("US-ASCII", fallback: proc { |c| s.replace("Z" * (16 * 1024 * 1024)) "?" }) ``` ASAN output (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free ... READ of size 1 #0 transcode_restartable0 transcode.c:592:36 (*in_p) #1 transcode_restartable transcode.c:828 #2 rb_transcoding_convert transcode.c:864 #3 trans_sweep transcode.c:1191 #4 rb_trans_conv transcode.c:1281 #5 rb_econv_convert0 transcode.c:1400 #6 rb_econv_convert transcode.c:1508 #7 transcode_loop transcode.c:2417 (goto resume -> rb_econv_convert) #8 str_transcode0 transcode.c:2877 #9 str_transcode transcode.c:2907 #10 str_encode transcode.c:2973 freed by thread T0 here: #15 proc_fallback transcode.c:2340 (rb_proc_call -> user code reallocs source) #16 transcode_loop_fallback_try transcode.c:2366 #18 transcode_loop transcode.c:2433 ``` -- https://bugs.ruby-lang.org/
Issue #22330 has been updated by k0kubun (Takashi Kokubun). Backport changed from 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ruby_4_0 commit:117b6497e781e39735ef14b942bad89cbc89872d. ---------------------------------------- Bug #22330: heap uaf from string.encode() https://bugs.ruby-lang.org/issues/22330#change-119442 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ---------------------------------------- Hello, a heap UAF seems possible in string's encode function. PoC ``` s = "あ" * 4000 s.encode("US-ASCII", fallback: proc { |c| s.replace("Z" * (16 * 1024 * 1024)) "?" }) ``` ASAN output (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free ... READ of size 1 #0 transcode_restartable0 transcode.c:592:36 (*in_p) #1 transcode_restartable transcode.c:828 #2 rb_transcoding_convert transcode.c:864 #3 trans_sweep transcode.c:1191 #4 rb_trans_conv transcode.c:1281 #5 rb_econv_convert0 transcode.c:1400 #6 rb_econv_convert transcode.c:1508 #7 transcode_loop transcode.c:2417 (goto resume -> rb_econv_convert) #8 str_transcode0 transcode.c:2877 #9 str_transcode transcode.c:2907 #10 str_encode transcode.c:2973 freed by thread T0 here: #15 proc_fallback transcode.c:2340 (rb_proc_call -> user code reallocs source) #16 transcode_loop_fallback_try transcode.c:2366 #18 transcode_loop transcode.c:2433 ``` -- https://bugs.ruby-lang.org/
participants (4)
-
danielchong (Daniel Chong) -
k0kubun (Takashi Kokubun)
-
nagachika (Tomoyuki Chikanaga)
-
peterzhu2118 (Peter Zhu)