Bug #13289: Integer overflow in str_byte_substr & rb_str_subpos when set SHARABLE_MIDDLE_SUBSTRING by 1

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: 2.4.0p0 (2016-12-24 revision 57164) [x86_64-linux]
• Backport: 2.2: UNKNOWN, 2.3: UNKNOWN, 2.4: DONE

[lung (Luc Nguyen)]

Integer overflow occurs in string.c(line 2319 & 5257).
beg + len & clen/n can be controlled by user.
Eg:

 a="B"*0x400
 a[0x40,0x7fffffffffffffff] => set length of sub array to 0x7fffffffffffffff

This lead to access out of bound memory if:

#define SHARABLE_MIDDLE_SUBSTRING 1

PoC attached.

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed

Applied in changeset r57799.

---

string.c: fix integer overflow

• string.c (str_byte_substr): fix another integer overflow which
  can happen only when SHARABLE_MIDDLE_SUBSTRING is enabled.
  [ruby-core:79951] [Bug #13289]

[naruse (Yui NARUSE)]

• Backport changed from 2.2: UNKNOWN, 2.3: UNKNOWN, 2.4: UNKNOWN to 2.2: UNKNOWN, 2.3: UNKNOWN, 2.4: DONE

ruby_2_4 r57931 merged revision(s) 57797,57799,57800.