From: "mame (Yusuke Endoh) via ruby-core" Date: 2026-11-09T09:55:15+00:00 Subject: [ruby-core:127372] [Ruby Bug#22518] String#unpack("m") computes the buffer size with an overflowing multiplication Issue #22518 has been reported by mame (Yusuke Endoh). ---------------------------------------- Bug #22518: String#unpack("m") computes the buffer size with an overflowing multiplication https://bugs.ruby-lang.org/issues/22518 * Author: mame (Yusuke Endoh) * Status: Open * Backport: 3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- `(send - s + 3) * 3 / 4` overflows where long is 32-bit: an input of about 700 MB is rejected, and an input of about 1.4 GB makes it allocate a buffer too small. ```ruby # On a platform where long is 32-bit (tested with a 32-bit build, gcc -m32): ("A" * 1_450_000_000).unpack1("m").bytesize # expected: 1087500000 # actual: [BUG] probable buffer overflow: 1087500000 for 13758178 ("A" * 800_000_000).unpack1("m").bytesize # expected: 600000000 # actual: negative string size (or size too big) (ArgumentError) ``` -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/