google / google/oss-fuzz

ruby `fuzz_prism` never calls `ruby_init()`, crashes on every non-empty input

Open Beginner friendly
#16,065 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

`projects/ruby/fuzz_prism.cpp` never calls `ruby_init()`, so
`pm_arena_new()` dies in `ruby_xcalloc` on a NULL VM before any input is parsed.

```cpp
if (size == 0)
return 0;
pm_arena_t *arena = pm_arena_new(); // line 37
```

In a CRuby build, Prism’s `xcalloc` is `ruby_xcalloc`, which reads
`GET_VM()->ractor.main_ractor`. The VM pointer is NULL, so the fault address is
`0x558`. The input is unused: every file of one byte or more crashes the same way.
The other Ruby harnesses in this project all call `ruby_init()`; this one does not.

```
==1991560==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000558
==1991560==The signal is caused by a READ memory access.
SCARINESS: 10 (null-deref)
#0 ruby_xcalloc_body /src/ruby/gc.c:5282
#1 ruby_xcalloc /src/ruby/gc.c:5276:34
#2 LLVMFuzzerTestOneInput /src/fuzz_prism.cpp:37:25
SUMMARY: AddressSanitizer: SEGV /src/ruby/gc.c:5282 in ruby_xcalloc_body
```

```sh
python3 infra/helper.py reproduce ruby fuzz_prism crash-00000289082f96f2c1a33d4217daceb834efb03c
```

Any non-empty file behaves the same.

The issue was already reported to ruby, and redirected here.

Found by the CISPA Fandango Team.

Contributor guide

Open the contributing guide

Research direction

Start with projects/ruby/fuzz_prism.cpp, especially LLVMFuzzerTestOneInput near line 37, and compare initialization with the other Ruby harnesses. Reproduce with python3 infra/helper.py reproduce ruby fuzz_prism crash-00000289082f96f2c1a33d4217daceb834efb03c. Done means non-empty inputs no longer crash before parsing.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, ruby
Domain
testing
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.