[ruby-core:116910] [Ruby master Bug#20292] Abort ruby by `String#initialize`

Issue #20292 has been updated by nobu (Nobuyoshi Nakada).


ksss (Yuki Kurihara) wrote:
> - String must be at least 64 characters long

Embedded string.

> - Call `#initialize` with capacity: 0 or less

Small but positive capacity also crashes.

Overwriting heap when initializing with smaller capacity.

----------------------------------------
Bug #20292: Abort ruby by `String#initialize`
https://bugs.ruby-lang.org/issues/20292#change-106944

* Author: ksss (Yuki Kurihara)
* Status: Open
* ruby -v: ruby 3.4.0dev (2024-02-22T06:43:46Z master e1c684e471) [arm64-darwin22]
* Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN
----------------------------------------
I found a code that causes an anomaly.

```
$ uname -a
Darwin 20208671n 22.6.0 Darwin Kernel Version 22.6.0: Wed Oct  4 21:26:55 PDT 2023; root:xnu-8796.141.3.701.17~4/RELEASE_ARM64_T6020 arm64

$ ruby -v
ruby 3.4.0dev (2024-02-22T06:43:46Z master e1c684e471) [arm64-darwin22]

$ ruby -e '100.times { "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".__send__(:initialize, capacity: -1) }'
ruby(13817,0x1f22b2080) malloc: Heap corruption detected, free list is damaged at 0x600000e27bc0
*** Incorrect guard value: 29830901955328
ruby(13817,0x1f22b2080) malloc: *** set a breakpoint in malloc_error_break to debug
[1]    13817 abort      ruby -e

$ ruby -e '100.times { "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".__send__(:initialize, capacity: 0) }'
# never return ....
```

My research indicates the following conditions.

- String must be at least 64 characters long
- Call `#initialize` with capacity: 0 or less
- Repeat this several times.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/