[ruby-core:118065] [Ruby master Bug#20292] Abort ruby by `String#initialize`
From:
"k0kubun (Takashi Kokubun) via ruby-core" <ruby-core@...>
Date:
2024-05-29 17:20:24 UTC
List:
ruby-core #118065
Issue #20292 has been updated by k0kubun (Takashi Kokubun).
Backport changed from 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: REQUIRED to 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: DONE
ruby_3_3 commit:f12c947192aa47b355015384e5c82cbf674023f1 merged revision(s) commit:e04146129ec6898dd6a9739dad2983c6e9b68056.
----------------------------------------
Bug #20292: Abort ruby by `String#initialize`
https://bugs.ruby-lang.org/issues/20292#change-108492
* Author: ksss (Yuki Kurihara)
* Status: Closed
* ruby -v: ruby 3.4.0dev (2024-02-22T06:43:46Z master e1c684e471) [arm64-darwin22]
* Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: DONE
----------------------------------------
I found a code that causes an anomaly.
```
$ uname -a
Darwin 20208671n 22.6.0 Darwin Kernel Version 22.6.0: Wed Oct 4 21:26:55 PDT 2023; root:xnu-8796.141.3.701.17~4/RELEASE_ARM64_T6020 arm64
$ ruby -v
ruby 3.4.0dev (2024-02-22T06:43:46Z master e1c684e471) [arm64-darwin22]
$ ruby -e '100.times { "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".__send__(:initialize, capacity: -1) }'
ruby(13817,0x1f22b2080) malloc: Heap corruption detected, free list is damaged at 0x600000e27bc0
*** Incorrect guard value: 29830901955328
ruby(13817,0x1f22b2080) malloc: *** set a breakpoint in malloc_error_break to debug
[1] 13817 abort ruby -e
$ ruby -e '100.times { "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".__send__(:initialize, capacity: 0) }'
# never return ....
```
My research indicates the following conditions.
- String must be at least 64 characters long
- Call `#initialize` with capacity: 0 or less
- Repeat this several times.
--
https://bugs.ruby-lang.org/
______________________________________________
ruby-core mailing list -- ruby-core@ml.ruby-lang.org
To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/