ruby `fuzz_prism` never calls `ruby_init()`, crashes on every non-empty input
- Dominant language
- Shell
- Stars
- 12.6k
- Forks
- 2.9k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 62
Description
`projects/ruby/fuzz_prism.cpp` never calls `ruby_init()`, so
`pm_arena_new()` dies in `ruby_xcalloc` on a NULL VM before any input is parsed.
```cpp
if (size == 0)
return 0;
pm_arena_t *arena = pm_arena_new(); // line 37
```
In a CRuby build, Prism’s `xcalloc` is `ruby_xcalloc`, which reads
`GET_VM()->ractor.main_ractor`. The VM pointer is NULL, so the fault address is
`0x558`. The input is unused: every file of one byte or more crashes the same way.
The other Ruby harnesses in this project all call `ruby_init()`; this one does not.
```
==1991560==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000558
==1991560==The signal is caused by a READ memory access.
SCARINESS: 10 (null-deref)
#0 ruby_xcalloc_body /src/ruby/gc.c:5282
#1 ruby_xcalloc /src/ruby/gc.c:5276:34
#2 LLVMFuzzerTestOneInput /src/fuzz_prism.cpp:37:25
SUMMARY: AddressSanitizer: SEGV /src/ruby/gc.c:5282 in ruby_xcalloc_body
```
```sh
python3 infra/helper.py reproduce ruby fuzz_prism crash-00000289082f96f2c1a33d4217daceb834efb03c
```
Any non-empty file behaves the same.
The issue was already reported to ruby, and redirected here.
Found by the CISPA Fandango Team.
Contributor guide
Research direction
Start with projects/ruby/fuzz_prism.cpp, especially LLVMFuzzerTestOneInput near line 37, and compare initialization with the other Ruby harnesses. Reproduce with python3 infra/helper.py reproduce ruby fuzz_prism crash-00000289082f96f2c1a33d4217daceb834efb03c. Done means non-empty inputs no longer crash before parsing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, ruby
- Domain
- testing
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100