From: "nagachika (Tomoyuki Chikanaga) via ruby-core" <ruby-core@...>
Date: 2026-09-20T06:32:19+00:00
Subject: [ruby-core:126803] [Ruby Bug#22318] heap uaf triggered in array.flatten

Issue #22318 has been updated by nagachika (Tomoyuki Chikanaga).

Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

ruby_3_4 commit:3ebd235fb667e37b9f5cb4dcf61b19f07c4d2b34 merged revision(s) commit:5eeaedc3d3014a12264aa252c751e14ba0fc5507.

----------------------------------------
Bug #22318: heap uaf triggered in array.flatten
https://bugs.ruby-lang.org/issues/22318#change-119112

* Author: danielchong (Daniel Chong)
* Status: Closed
* ruby -v: 4.1.0dev
* Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED
----------------------------------------
Hello, there seems to be a bug in Array's flatten function.

PoC:
```
a = (1..2000).to_a
bad = Object.new
$a = a
def bad.to_ary; $a.clear; [1,2,3]; end
a << bad       
a.flatten
```

ASAN output (truncated):
```
7==ERROR: AddressSanitizer: heap-buffer-overflow ...
READ of size 16000 ... thread T0
    #3 ary_memcpy0  array.c:354
    #4 ary_memcpy   array.c:371
    #5 flatten       array.c:6715            <-- USE (stale count i)
    #6 rb_ary_flatten array.c:6924
0x... is located 0 bytes after 256-byte region [...]
allocated by thread T0 here:
    #4 ary_heap_realloc  array.c:396
    #5 ary_resize_capa   array.c:439
    #6 rb_ary_clear      array.c:4988         <-- SHRINK (via to_ary)
    ...
    #18 convert_type_with_id       object.c:3303
    #21 rb_check_array_type        array.c:1032
    #22 flatten                    array.c:6705  <-- reentrant conversion
```



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/