Issue #22262 has been updated by kddnewton (Kevin Newton). You should open an issue on the google oss-fuzz repo, I didn't even know that thing existed. It is clearly wrong. ---------------------------------------- Misc #22262: OSS-Fuzz `fuzz_prism` target never calls `ruby_init()`, so Prism is not being fuzzed https://bugs.ruby-lang.org/issues/22262#change-118656 * Author: schecki (Tim Scheckenbach) * Status: Open ---------------------------------------- The OSS-Fuzz fuzz target `fuzz_prism` crashes on every non-empty input before it reaches the parser, so Prism has never actually been fuzzed. The harness source lives in OSS-Fuzz (`projects/ruby/fuzz_prism.cpp`), not in this repository, but it is Ruby's fuzzing integration and one of the ten Ruby targets is producing nothing but false positives. Input (attached): ```ruby #!/usr/bin/ruby -w # warn_indent: true undef uI1y36L9!, uI1y36L9! ``` ``` ==1991560==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000558 ==1991560==The signal is caused by a READ memory access. SCARINESS: 10 (null-deref) #0 ruby_xcalloc_body /src/ruby/gc.c:5282 #1 ruby_xcalloc /src/ruby/gc.c:5276:34 #2 LLVMFuzzerTestOneInput /src/fuzz_prism.cpp:37:25 ``` `fuzz_prism.cpp:37` is `pm_arena_t *arena = pm_arena_new();`, the first statement after the `size == 0` guard. `pm_arena_new()` is `xcalloc(1, sizeof(pm_arena_t))` (`prism/arena.c`), and in a CRuby build `xcalloc` is `ruby_xcalloc`, which reaches `rb_gc_impl_calloc(rb_gc_get_objspace(), ...)`. `rb_gc_get_objspace()` ends up reading `GET_VM()->ractor.main_ractor`, but the harness never calls `ruby_init()`, so `ruby_current_vm_ptr` is `NULL` and the read lands at `offsetof(rb_vm_t, ractor.main_ractor)` = `0x558` — the faulting address above, confirmed by `rdi = 0x558` in the register dump. The attached input is irrelevant to the crash: `pm_arena_new()` runs before any byte of `data` is examined, so every file of one byte or more fails identically. A zero-byte file is the only input that survives, via the `size == 0` guard. This is not a regression. `fuzz_prism.cpp` has two commits — `97728d6` (`ruby: initial integration`, oss-fuzz#14312, 2025-11-19) and `51fea8a` (`ruby: fix build`, oss-fuzz#15217, 2026-03-26) — and neither added `ruby_init()`. `51fea8a` moved the harness onto Prism's arena API, which only relocated the crash: the previous code called `pm_parser_init`, which reaches `pm_constant_pool_init`, which also calls `xcalloc`. `fuzz_prism.cpp` is the only one of the ten targets in `projects/ruby` missing `ruby_init()`; the other nine all have it. Unsure if this is the correct place to report this issue, but I'm also happy to open the issue somewhere else. Found by the CISPA Fandango Team. ---Files-------------------------------- crash-00000289082f96f2c1a33d4217daceb834efb03c (66 Bytes) -- https://bugs.ruby-lang.org/