From: "mame (Yusuke Endoh) via ruby-core" Date: 2026-11-09T09:07:33+00:00 Subject: [ruby-core:127370] [Ruby Bug#22517] Some String methods return a UTF-16/32 string without room for its terminator Issue #22517 has been reported by mame (Yusuke Endoh). ---------------------------------------- Bug #22517: Some String methods return a UTF-16/32 string without room for its terminator https://bugs.ruby-lang.org/issues/22517 * Author: mame (Yusuke Endoh) * Status: Open * Backport: 3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- Case mapping, `String#reverse`, `String#succ`, `String#scrub`, `String#slice!`, string interpolation and `String#-@` can return a UTF-16 or UTF-32 string allocated with room for a 1-byte terminator only, so filling the 2- or 4-byte terminator later, such as in `Process.setproctitle`, writes beyond the allocation. Each of the following lines makes AddressSanitizer report a heap-buffer-overflow in `str_fill_term` (no visible error on a release build). ```ruby s = ("a" * 1000).encode("UTF-32LE") Process.setproctitle(s.downcase) # ASAN: heap-buffer-overflow, WRITE of size 4 Process.setproctitle(s.reverse) # ASAN: heap-buffer-overflow, WRITE of size 4 Process.setproctitle(s.succ) # ASAN: heap-buffer-overflow, WRITE of size 4 Process.setproctitle(s.dup.slice!(0, 900)) # ASAN: heap-buffer-overflow, WRITE of size 4 Process.setproctitle("#{s}#{s}") # ASAN: heap-buffer-overflow, WRITE of size 4 Process.setproctitle("#{s.b.force_encoding("US-ASCII")}#{s[0, 0]}") # ASAN: heap-buffer-overflow, WRITE of size 4 Process.setproctitle(s.b.tr("\0", "\xDC".b).force_encoding(s.encoding).scrub) # ASAN: heap-buffer-overflow, WRITE of size 4 Process.setproctitle(-Ractor.make_shareable(Class.new(String).new(s))) # ASAN: heap-buffer-overflow, READ of size 1 ``` -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/