[#84867] [Ruby trunk Bug#14357] thread_safe tests suite segfaults — v.ondruch@...

Issue #14357 has been reported by vo.x (Vit Ondruch).

11 messages 2018/01/15
[#85364] Re: [Ruby trunk Bug#14357] thread_safe tests suite segfaults — Eric Wong <normalperson@...> 2018/02/03

v.ondruch@tiscali.cz wrote:

[#84980] [Ruby trunk Feature#13618][Assigned] [PATCH] auto fiber schedule for rb_wait_for_single_fd and rb_waitpid — hsbt@...

Issue #13618 has been updated by hsbt (Hiroshi SHIBATA).

10 messages 2018/01/23
[#85012] Re: [Ruby trunk Feature#13618][Assigned] [PATCH] auto fiber schedule for rb_wait_for_single_fd and rb_waitpid — Eric Wong <normalperson@...> 2018/01/23

hsbt@ruby-lang.org wrote:

[ruby-core:84872] [Ruby trunk Bug#14359] IO#ungetbyte integer overflow

From: shyouhei@...
Date: 2018-01-15 13:54:38 UTC
List: ruby-core #84872
Issue #14359 has been reported by shyouhei (Shyouhei Urabe).

----------------------------------------
Bug #14359: IO#ungetbyte integer overflow
https://bugs.ruby-lang.org/issues/14359

* Author: shyouhei (Shyouhei Urabe)
* Status: Open
* Priority: Normal
* Assignee: 
* Target version: 
* ruby -v: 
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
In Ruby's IO, a "byte" means an integer of range 0...256.
However IO#ungetbyte is the only exception.
It does not check the argument to accept liberal integers.

```ruby
File.open("/dev/zero") {|f| f.ungetbyte(-1); p f.read(2) } # => "\xFF\x00"
File.open("/dev/zero") {|f| f.ungetbyte(257); p f.read(2) } # => "\x01\x00"
```

I see no vulnerability so just filing this as a normal bug.



-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>

In This Thread

Prev Next