From: "stephankaag (Stephan Kaag) via ruby-core" Date: 2026-10-22T07:51:37+00:00 Subject: [ruby-core:127208] [Ruby Bug#22464] Backport #16801 (overflowed repeat/null-check IDs in Onigmo) to 4.0 and 3.4; missing from 4.0.8 despite its release notes Issue #22464 has been reported by stephankaag (Stephan Kaag). ---------------------------------------- Bug #22464: Backport #16801 (overflowed repeat/null-check IDs in Onigmo) to 4.0 and 3.4; missing from 4.0.8 despite its release notes https://bugs.ruby-lang.org/issues/22464 * Author: stephankaag (Stephan Kaag) * Status: Open * ruby -v: ruby 4.0.8 (2026-10-22 revision 60c3d71bfb) +PRISM [arm64-darwin27] * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- PR https://github.com/ruby/ruby/pull/16801 (commit 493d26dcde, merged 2026-04-29) rejects a regexp with more than 32767 counted repeats. Without it the repeat ID, a signed 16-bit value, wraps and the matcher writes out of bounds. GitLab shipped this fix on 2026-10-21 as part of CVE-2026-110264 (CVSS 10.0) for its bundled Ruby 3.3, 3.4 and 4.0. The fix is on master only. Ruby 4.0.8 (released 2026-10-22) does not contain it: * `include/ruby/onigmo.h` at v4.0.8 has `ONIGERR_TOO_BIG_COMPILED_PROGRAM` (-226) but not `ONIGERR_TOO_MANY_RANGE_REPEAT` (-224) or `ONIGERR_TOO_MANY_NULL_CHECK` (-225). * `regcomp.c` and `regerror.c` at v4.0.8 have no reference to these errors. * On a build of v4.0.8, `Regexp.new("(?:foobar){0,100}" * 40000)` compiles without error. With #16801 it raises RegexpError. The auto-generated GitHub release notes of v4.0.8 list the PR, which suggests the backport was intended. Please backport 493d26dcde to ruby_4_0 and ruby_3_4. The backport of the program size fixes (#19025) is already on both branches and in 4.0.8. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/