Bug #22318: heap uaf triggered in array.flatten

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: 4.1.0dev
• Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

[danielchong (Daniel Chong)]

Hello, there seems to be a bug in Array's flatten function.

PoC:

a = (1..2000).to_a
bad = Object.new
$a = a
def bad.to_ary; $a.clear; [1,2,3]; end
a << bad       
a.flatten

ASAN output (truncated):

7==ERROR: AddressSanitizer: heap-buffer-overflow ...
READ of size 16000 ... thread T0
    #3 ary_memcpy0  array.c:354
    #4 ary_memcpy   array.c:371
    #5 flatten       array.c:6715            <-- USE (stale count i)
    #6 rb_ary_flatten array.c:6924
0x... is located 0 bytes after 256-byte region [...]
allocated by thread T0 here:
    #4 ary_heap_realloc  array.c:396
    #5 ary_resize_capa   array.c:439
    #6 rb_ary_clear      array.c:4988         <-- SHRINK (via to_ary)
    ...
    #18 convert_type_with_id       object.c:3303
    #21 rb_check_array_type        array.c:1032
    #22 flatten                    array.c:6705  <-- reentrant conversion

[peterzhu2118 (Peter Zhu)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for the bug report. I have a fix here. I have also requested backports to Ruby 3.4 and 4.0.

[peterzhu2118 (Peter Zhu)]

• Status changed from Open to Closed

Applied in changeset git|5eeaedc3d3014a12264aa252c751e14ba0fc5507.

---

Fix use-after-free when clearing array during flatten

[Bug #22318]

Array#flatten triggers an use-after-free it does not account for when the
call to rb_check_array_type modifies the source array. The following script
crashes:

a = (1..100_000).to_a
$a = a
bad = Object.new
def bad.to_ary; $a.clear; [1,2,3]; end
a << bad
a.flatten

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

ruby_3_4 3ebd235fb667e37b9f5cb4dcf61b19f07c4d2b34 merged revision(s) 5eeaedc3d3014a12264aa252c751e14ba0fc5507.