Misc #22262: OSS-Fuzz `fuzz_prism` target never calls `ruby_init()`, so Prism is not being fuzzed

• Status: Third Party's Issue
• Assignee: -

[schecki (Tim Scheckenbach)]

The OSS-Fuzz fuzz target fuzz_prism crashes on every non-empty input before it reaches
the parser, so Prism has never actually been fuzzed. The harness source lives in OSS-Fuzz
(projects/ruby/fuzz_prism.cpp), not in this repository, but it is Ruby's fuzzing
integration and one of the ten Ruby targets is producing nothing but false positives.

Input (attached):

#!/usr/bin/ruby -w
# warn_indent: true
undef uI1y36L9!, uI1y36L9!

==1991560==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000558
==1991560==The signal is caused by a READ memory access.
SCARINESS: 10 (null-deref)
    #0 ruby_xcalloc_body /src/ruby/gc.c:5282
    #1 ruby_xcalloc /src/ruby/gc.c:5276:34
    #2 LLVMFuzzerTestOneInput /src/fuzz_prism.cpp:37:25

fuzz_prism.cpp:37 is pm_arena_t *arena = pm_arena_new();, the first statement after
the size == 0 guard. pm_arena_new() is xcalloc(1, sizeof(pm_arena_t))
(prism/arena.c), and in a CRuby build xcalloc is ruby_xcalloc, which reaches
rb_gc_impl_calloc(rb_gc_get_objspace(), ...). rb_gc_get_objspace() ends up reading
GET_VM()->ractor.main_ractor, but the harness never calls ruby_init(), so
ruby_current_vm_ptr is NULL and the read lands at
offsetof(rb_vm_t, ractor.main_ractor) = 0x558 — the faulting address above, confirmed
by rdi = 0x558 in the register dump.

The attached input is irrelevant to the crash: pm_arena_new() runs before any byte of
data is examined, so every file of one byte or more fails identically. A zero-byte file
is the only input that survives, via the size == 0 guard.

This is not a regression. fuzz_prism.cpp has two commits — 97728d6
(ruby: initial integration, oss-fuzz#14312, 2025-11-19) and 51fea8a
(ruby: fix build, oss-fuzz#15217, 2026-03-26) — and neither added ruby_init().
51fea8a moved the harness onto Prism's arena API, which only relocated the crash: the
previous code called pm_parser_init, which reaches pm_constant_pool_init, which also
calls xcalloc. fuzz_prism.cpp is the only one of the ten targets in projects/ruby
missing ruby_init(); the other nine all have it.

Unsure if this is the correct place to report this issue, but I'm also happy to open the issue somewhere else.

Found by the CISPA Fandango Team.

[kddnewton (Kevin Newton)]

You should open an issue on the google oss-fuzz repo, I didn't even know that thing existed. It is clearly wrong.

[Earlopain (Earlopain _)]

• Status changed from Open to Third Party's Issue