Bug #22336: IO:Buffer Heap uaf

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: 4.1.0-dev
• Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

[danielchong (Daniel Chong)]

Hello, a UAF is possible in IO:Buffer.

PoC:

$buf = IO::Buffer.new(64)  
evil = Object.new
def evil.to_str
  $buf.resize(64 * 1024 * 1024) 
  "UTF-8"
end
$buf.get_string(0, 32, evil)   

ASAN (truncated):

ERROR: AddressSanitizer: heap-use-after-free ... READ of size 32
    #3 str_enc_new string.c:1109
    #4 io_buffer_get_string io_buffer.c:3276           <- USE (read from stale base)
freed by thread T0 here:
    #0 realloc
    #1 rb_io_buffer_resize io_buffer.c:2203            <- FREE (realloc move)
    #2 io_buffer_resize io_buffer.c:2249
    ...
    #16 rb_str_to_str string.c:1818
    #18 name_for_encoding encoding.c:296
    #20 rb_find_encoding encoding.c:345
    #21 io_buffer_get_string io_buffer.c:3266          <- reentrancy boundary (encoding to_str)
previously allocated by thread T0 here:
    #0 calloc
    #1 io_buffer_initialize io_buffer.c:216            <- original 64-byte INTERNAL buffer

[peterzhu2118 (Peter Zhu)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for the bug report, I have a fix here.

[peterzhu2118 (Peter Zhu)]

• Status changed from Open to Closed

Applied in changeset git|b61da996afb02715cb16703a55f57c4417fd2d5b.

---

[Bug #22336] Fix use-after-free in IO::Buffer#get_string. (#18919)

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

ruby_3_4 bce3c89801d667a2cc38940228b8656f46879e7e merged revision(s) b61da996afb02715cb16703a55f57c4417fd2d5b.