From: "eightbitraptor (Matt V-H) via ruby-core" <ruby-core@...>
Date: 2026-09-16T21:14:20+00:00
Subject: [ruby-core:126746] [Ruby Bug#22325] out of bounds read in array

Issue #22325 has been updated by eightbitraptor (Matt V-H).


https://github.com/ruby/ruby/pull/18876

----------------------------------------
Bug #22325: out of bounds read in array
https://bugs.ruby-lang.org/issues/22325#change-119043

* Author: danielchong (Daniel Chong)
* Status: Open
* ruby -v: 4.1.0dev
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
Hi, an OOB read seems possible in array

```
class bad < Numeric
  def initialize(v); @v = v; end
  def val; @v; end
  def <=>(o); @v <=> (o.is_a?(bad) ? o.val : o); end
  def to_int; $a.clear; @v; end
  def to_i; @v; end
  def coerce(o); [o, @v]; end
end
$a = (1..3000).to_a
seq = Range.new(bad.new(2900), bad.new(2950)).step(2)  
```

asan output (truncated):
```
ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ...
    #0 ary_make_partial_step  array.c:1303
    #1 rb_ary_aref1           array.c:1947
    #2 vm_opt_aref            vm_insnhelper.c:7224
SUMMARY: AddressSanitizer: heap-buffer-overflow array.c:1303:9 in ary_make_partial_step
```



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/