Bug #22518: String#unpack("m") computes the buffer size with an overflowing multiplication

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED

[mame (Yusuke Endoh)]

(send - s + 3) * 3 / 4 overflows where long is 32-bit: an input of about 700 MB is rejected, and an input of about 1.4 GB makes it allocate a buffer too small.

# On a platform where long is 32-bit (tested with a 32-bit build, gcc -m32):
("A" * 1_450_000_000).unpack1("m").bytesize
# expected: 1087500000
# actual:   [BUG] probable buffer overflow: 1087500000 for 13758178

("A" * 800_000_000).unpack1("m").bytesize
# expected: 600000000
# actual:   negative string size (or size too big) (ArgumentError)

[mame (Yusuke Endoh)]

https://github.com/ruby/ruby/pull/19797

[mame (Yusuke Endoh)]

• Status changed from Open to Closed

Applied in changeset git|9deaec155c201ac11342adbd416bfeba42031d27.

---

Compute the buffer size of unpack("m") without overflow

(send - s + 3) * 3 / 4 overflowed for an input of about 700 MB where
long is 32-bit. Divide before multiplying, as each 4 characters decode
to at most 3 bytes.

[Bug #22518]

Co-Authored-By: Claude Opus 5.5 [e-mail]