Bug #22330: heap uaf from string.encode()

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: 4.1.0-dev
• Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

[danielchong (Daniel Chong)]

Hello, a heap UAF seems possible in string's encode function.

PoC

s = "あ" * 4000                                 
s.encode("US-ASCII",                                
         fallback: proc { |c|
           s.replace("Z" * (16 * 1024 * 1024))      
           "?"
         })

ASAN output (truncated):

ERROR: AddressSanitizer: heap-use-after-free ... READ of size 1
    #0 transcode_restartable0        transcode.c:592:36   (*in_p)
    #1 transcode_restartable         transcode.c:828
    #2 rb_transcoding_convert        transcode.c:864
    #3 trans_sweep                   transcode.c:1191
    #4 rb_trans_conv                  transcode.c:1281
    #5 rb_econv_convert0             transcode.c:1400
    #6 rb_econv_convert              transcode.c:1508
    #7 transcode_loop                transcode.c:2417   (goto resume -> rb_econv_convert)
    #8 str_transcode0                transcode.c:2877
    #9 str_transcode                 transcode.c:2907
    #10 str_encode                   transcode.c:2973
freed by thread T0 here:
    #15 proc_fallback               transcode.c:2340   (rb_proc_call -> user code reallocs source)
    #16 transcode_loop_fallback_try transcode.c:2366
    #18 transcode_loop              transcode.c:2433

[peterzhu2118 (Peter Zhu)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for the bug report, I have a fix here.

[peterzhu2118 (Peter Zhu)]

• Status changed from Open to Closed

Applied in changeset git|c914aeb622ce7337223cd5c23f30daf9f7d3e7c4.

---

Fix use-after-free in String#encode when string modified

[Bug #22330]

The following script demonstrates a use-afer-free where we see corruption:

s = "あ" * 10_000
s.encode("US-ASCII", fallback: proc { |c| s.clear; "?" })

Raises may different errors such as:

"\xCB" followed by "\xF5" on UTF-8 (Encoding::InvalidByteSequenceError)
"\xF4" followed by "r" on UTF-8 (Encoding::InvalidByteSequenceError)
"\x8B" on UTF-8 (Encoding::InvalidByteSequenceError)