Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Jun 2008 10:37:20 -0800
From: Jonathan Smith <>
To: Drew Yao <>
CC: Vendor-Sec Distribution Vendors <>,
Subject: ruby regression (was: Re: [vendor-sec] Ruby memory corruption bugs
 in array and string handling)

Hash: SHA256

Since this is public now, I'm CCing oss-security (and trimming the CC
list of people known to be on that list).

My comments are inline...

Drew Yao wrote:
> Also in case anyone was wondering about the comments on
> the ruby version that was released to fix these introduced a regression.
> ruby -ve ’str = “A”*(2**16) ; loop{ str << str ; puts str.size }’

The above command does crash for me using ruby 1.8.6p230 on rPath Linux
2 or Foresight Linux 2. However, the test suite ("make test" in the
build dir) passes. It was my understanding that the test suite should
fail, given my reading of the forum thread linked to by the blog post
Drew mentioned above:

> causes a crash with 1.8.6p231 and 1.8.7p22.

Where did you get 1.8.6p231? The latest I see is 1.8.6p230, which,
according to upstream's advisory [1], fixes the security issues.

> That crash is fixed by this patch

Applying that patch, the segfault does go away. I get another
(presumably correct) error message:
- -e:1:in `<<': string sizes too big (ArgumentError)
        from -e:1
        from -e:1:in `loop'
        from -e:1

> This issue doesn't exist on versions of Ruby before the recent patches,
> because in the old versions, str_buf_append didn't exist. 
> rb_str_buf_append takes two RString pointers, so if str and str2 are the
> same, when str->ptr gets realloced, str2->ptr also gets realloced.  This
> also does not affect the patched version if you used the patches I sent
> originally.

Thanks for the info.



Version: GnuPG v2.0.9 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.