From: "nagachika (Tomoyuki Chikanaga) via ruby-core" <ruby-core@...>
Date: 2026-09-20T06:09:36+00:00
Subject: [ruby-core:126797] [Ruby Bug#22319] heap buffer overflow triggered by array's zip function

Issue #22319 has been updated by nagachika (Tomoyuki Chikanaga).

Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

ruby_3_4 commit:a03cc5f2c3d4918dc3cf2c75c181a1923b5d692f merged revision(s) commit:0c9f3f1e68e23a9ba2d7fdfdb86bd7ddcaf5e9d9.

----------------------------------------
Bug #22319: heap buffer overflow triggered by array's zip function
https://bugs.ruby-lang.org/issues/22319#change-119105

* Author: danielchong (Daniel Chong)
* Status: Closed
* ruby -v: 4.1.0dev
* Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED
----------------------------------------
Hi, I found a heap buffer overflow affecting array's zip functionality.

PoC:
```
a = (1..3000).to_a
evil = Object.new; $a = a
def evil.to_ary; $a.clear; [1,2,3]; end
a.zip(evil) 
```

ASAN output (truncated):
ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 ...
    #0 RARRAY_AREF  internal/array.h:153
    #1 rb_ary_zip   array.c:4850              <-- USE (stale len)
0x... is located 0 bytes after 256-byte region [...]
allocated by thread T0 here:
    #4 ary_heap_realloc array.c:396
    #5 ary_resize_capa  array.c:439
    #6 rb_ary_clear     array.c:4988          <-- SHRINK (via arg's to_ary)
    ...
    #18 convert_type_with_id object.c:3303    <-- take_items -> to_ary



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/