Actions
Bug #22517
closed
Some String methods return a UTF-16/32 string without room for its terminator
Bug #22517:
Some String methods return a UTF-16/32 string without room for its terminator
Description
Case mapping, String#reverse, String#succ, String#scrub, String#slice!, string interpolation and String#-@ can return a UTF-16 or UTF-32 string allocated with room for a 1-byte terminator only, so filling the 2- or 4-byte terminator later, such as in Process.setproctitle, writes beyond the allocation.
Each of the following lines makes AddressSanitizer report a heap-buffer-overflow in str_fill_term (no visible error on a release build).
s = ("a" * 1000).encode("UTF-32LE")
Process.setproctitle(s.downcase) # ASAN: heap-buffer-overflow, WRITE of size 4
Process.setproctitle(s.reverse) # ASAN: heap-buffer-overflow, WRITE of size 4
Process.setproctitle(s.succ) # ASAN: heap-buffer-overflow, WRITE of size 4
Process.setproctitle(s.dup.slice!(0, 900)) # ASAN: heap-buffer-overflow, WRITE of size 4
Process.setproctitle("#{s}#{s}") # ASAN: heap-buffer-overflow, WRITE of size 4
Process.setproctitle("#{s.b.force_encoding("US-ASCII")}#{s[0, 0]}") # ASAN: heap-buffer-overflow, WRITE of size 4
Process.setproctitle(s.b.tr("\0", "\xDC".b).force_encoding(s.encoding).scrub) # ASAN: heap-buffer-overflow, WRITE of size 4
Process.setproctitle(-Ractor.make_shareable(Class.new(String).new(s))) # ASAN: heap-buffer-overflow, READ of size 1
Updated by
Actions