Bug #22325: out of bounds read in array

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: 4.1.0dev
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[danielchong (Daniel Chong)]

Hi, an OOB read seems possible in array

class bad < Numeric
  def initialize(v); @v = v; end
  def val; @v; end
  def <=>(o); @v <=> (o.is_a?(bad) ? o.val : o); end
  def to_int; $a.clear; @v; end
  def to_i; @v; end
  def coerce(o); [o, @v]; end
end
$a = (1..3000).to_a
seq = Range.new(bad.new(2900), bad.new(2950)).step(2)  

asan output (truncated):

ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ...
    #0 ary_make_partial_step  array.c:1303
    #1 rb_ary_aref1           array.c:1947
    #2 vm_opt_aref            vm_insnhelper.c:7224
SUMMARY: AddressSanitizer: heap-buffer-overflow array.c:1303:9 in ary_make_partial_step

[eightbitraptor (Matt V-H)]

https://github.com/ruby/ruby/pull/18876

[eightbitraptor (Matt V-H)]

• Status changed from Open to Closed

Applied in changeset git|8befacf9e6c898a0f79dcb53bdd2e4cea24e0d1c.

---

Guard against oob read in rb_ary_aref1

When the array is shrunk during rb_arithmetic_sequence_beg_len_step,
ary_subseq_len returns -1. Return an empty array instead of passing the
negative length to ary_make_partial or ary_make_partial_step.

[Bug #22325]