Ruby Issue Tracking System

05/14/2025

07:16 AM Ruby Bug #21333: heap-use-after-free caused by rehash during update

byroot (Jean Boussier) wrote in #note-3:
> So `#update` with block isn't considered iteration, so it doesn't increase the `iterlevel` hence `#rehash` is mistakenly allowed.
> ...
byroot (Jean Boussier) wrote in #note-2:
> ```ruby
> .... cyruscyliu (Qiang Liu)

05/13/2025

12:19 PM Ruby Bug #21333 (Closed): heap-use-after-free caused by rehash during update

Hi, we found a heap-use-after-free caused by rehash during update
```
$a = (1..1337).to_h { |k| [k, k] }
$a.update($b) { |k, o, n|
$a.rehash
}
```
```
$ git log | head -n4
commit a6435befa76c2ae0525147f934bd9cd1914ffb8a
... cyruscyliu (Qiang Liu)

12:19 PM Ruby Bug #21332 (Closed): heap-use-after-free caused by mutating the set

Hi, we found a heap-use-after-free caused by mutating the set.
hash() returning 0 is important to create the collision and then trigger eql?
```
$flag = false
$c = 0
class C
def hash
return 0
end
def eq... cyruscyliu (Qiang Liu)

12:18 PM Ruby Bug #21331 (Closed): heap-use-after-free caused by rehash during transform_values!

Hi, we found a heap-use-after-free caused by rehash during transform_values!.
```
$a = (1..1337).to_h { |k| [k, k] }
$a.transform_values! { |v|
$a.rehash
v * 2
}
```
```
$ git log | head -n4
commit a6435befa76c2ae05... cyruscyliu (Qiang Liu)

05/03/2025

01:26 PM Ruby Bug #21306 (Closed): heap-use-after-free in set initialization via clearing the array while it’s being iterated

Hi, we found a heap-use-after-free in set initialization
via clearing the array while it’s being iterated. Here is the PoC.
```
$a = (1..100).to_a
s = Set.new($a) { |x|
$a.clear
}
```
Initializing a Set with an array th... cyruscyliu (Qiang Liu)

01:19 PM Ruby Bug #21305 (Closed): heap-use-after-free of set#merge via mutating hash method

Hi, we found a heap-use-after-free of set#merge via mutating hash method. Here
is the PoC.
```
class C
def hash
$a.clear
return 0
end
end
$a = (1..100).to_a
$a.insert(0, C.new)
$b = Set.new([])
$b.... cyruscyliu (Qiang Liu)

01:14 PM Ruby Bug #21304 (Closed): heap-use-after-free of Array#hash via mutating hash method

Hi, we found a heap-use-after-free of Array#hash via mutating hash method. Here
is the PoC.
```
class C
def hash()
puts $a
$a.push(*1..100000)
return 0
end
end
c = C.new
$a = [c]
$a.push(*1... cyruscyliu (Qiang Liu)

12:55 PM Ruby Bug #21303 (Closed): heap-buffer-overflow of Array#difference via mutating hash method

Hi, we found a heap-buffer-overflow of Array#difference via mutating hash
method. Here is the PoC.
```
class C
def hash
$a.clear
return 0
end
def eql?(other)
return true
end
end
$... cyruscyliu (Qiang Liu)