Project

General

Profile

Actions
Copy link

Bug #22461

closed

Use-after-free in `String` formatting with wide character encodings

Bug #22461: Use-after-free in `String` formatting with wide character encodings

Added by nobu (Nobuyoshi Nakada) 1 day ago. Updated 1 day ago.

Status:
Closed
Assignee:
-
Target version:
-
ruby -v:
Backport:
3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED
[ruby-core:127200]

Description

A heap use-after-free bug exists in Ruby's string formatting implementation (String#% and Kernel#sprintf) when processing wide character encoded strings.

Updated by nobu (Nobuyoshi Nakada) 1 day ago Actions
Copy link
 #1

  • Description updated (diff)

Updated by nobu (Nobuyoshi Nakada) 1 day ago Actions
Copy link
 #3

  • Status changed from Open to Closed

Applied in changeset git|faefcb11050ea61ee011e3b73c929ff406d30b68.

[Bug #22461] Fix dangling pointers after associating encoding

rb_enc_associate may re-allocate the string buffer because of the
terminator length change.

Actions
Copy link

Also available in: PDF Atom