From: "kddnewton (Kevin Newton) via ruby-core" <ruby-core@...>
Date: 2026-08-25T15:26:22+00:00
Subject: [ruby-core:126498] [Ruby Misc#22262] OSS-Fuzz `fuzz_prism` target never calls `ruby_init()`, so Prism is not being fuzzed

Issue #22262 has been updated by kddnewton (Kevin Newton).


You should open an issue on the google oss-fuzz repo, I didn't even know that thing existed. It is clearly wrong.

----------------------------------------
Misc #22262: OSS-Fuzz `fuzz_prism` target never calls `ruby_init()`, so Prism is not being fuzzed
https://bugs.ruby-lang.org/issues/22262#change-118656

* Author: schecki (Tim Scheckenbach)
* Status: Open
----------------------------------------
The OSS-Fuzz fuzz target `fuzz_prism` crashes on every non-empty input before it reaches
the parser, so Prism has never actually been fuzzed. The harness source lives in OSS-Fuzz
(`projects/ruby/fuzz_prism.cpp`), not in this repository, but it is Ruby's fuzzing
integration and one of the ten Ruby targets is producing nothing but false positives.

Input (attached):

```ruby
#!/usr/bin/ruby -w
# warn_indent: true
undef uI1y36L9!, uI1y36L9!
```

```
==1991560==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000558
==1991560==The signal is caused by a READ memory access.
SCARINESS: 10 (null-deref)
    #0 ruby_xcalloc_body /src/ruby/gc.c:5282
    #1 ruby_xcalloc /src/ruby/gc.c:5276:34
    #2 LLVMFuzzerTestOneInput /src/fuzz_prism.cpp:37:25
```

`fuzz_prism.cpp:37` is `pm_arena_t *arena = pm_arena_new();`, the first statement after
the `size == 0` guard. `pm_arena_new()` is `xcalloc(1, sizeof(pm_arena_t))`
(`prism/arena.c`), and in a CRuby build `xcalloc` is `ruby_xcalloc`, which reaches
`rb_gc_impl_calloc(rb_gc_get_objspace(), ...)`. `rb_gc_get_objspace()` ends up reading
`GET_VM()->ractor.main_ractor`, but the harness never calls `ruby_init()`, so
`ruby_current_vm_ptr` is `NULL` and the read lands at
`offsetof(rb_vm_t, ractor.main_ractor)` = `0x558` ��� the faulting address above, confirmed
by `rdi = 0x558` in the register dump.

The attached input is irrelevant to the crash: `pm_arena_new()` runs before any byte of
`data` is examined, so every file of one byte or more fails identically. A zero-byte file
is the only input that survives, via the `size == 0` guard.

This is not a regression. `fuzz_prism.cpp` has two commits ��� `97728d6`
(`ruby: initial integration`, oss-fuzz#14312, 2025-11-19) and `51fea8a`
(`ruby: fix build`, oss-fuzz#15217, 2026-03-26) ��� and neither added `ruby_init()`.
`51fea8a` moved the harness onto Prism's arena API, which only relocated the crash: the
previous code called `pm_parser_init`, which reaches `pm_constant_pool_init`, which also
calls `xcalloc`. `fuzz_prism.cpp` is the only one of the ten targets in `projects/ruby`
missing `ruby_init()`; the other nine all have it.

Unsure if this is the correct place to report this issue, but I'm also happy to open the issue somewhere else.

Found by the CISPA Fandango Team.

---Files--------------------------------
crash-00000289082f96f2c1a33d4217daceb834efb03c (66 Bytes)


-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/