Bug #22512: Overflow in `st_init_existing_table_with_size` / `Hash.new(capacity:)`

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

[byroot (Jean Boussier)]

If provided a large enough size, st_init_existing_table_with_size and Hash.new(capacity:) can overflow instead of raising, which could ultimately lead to a crash.

That being said, this bug isn't treated as a security vulnerability, because by design using an unstrusted number as a capacity open to DOS attacks regardless of the overflow.

Patch: https://github.com/ruby/ruby/pull/19773

[byroot (Jean Boussier)]

• Status changed from Open to Closed

Applied in changeset git|165bb8173f577bcef6103ba0ba19f7596efa23e5.

---

st.c: recompute MAX_POWER2

Remove the entries that would result in an overflow if allocated.

[Bug #22512]

[byroot (Jean Boussier)]

Backport PRs:

• 4.0 https://github.com/ruby/ruby/pull/19775
• 3.4 https://github.com/ruby/ruby/pull/19776