4c1a74b64f (master): fix out-of-bounds read in strftime %Z zone name copy
0 views
Skip to first unread message
Zibran Khan
Oct 5, 2026, 9:40:21 PM (20 hours ago) Oct 5
to ruby...@g.ruby-lang.org
Zibran Khan 2026-10-05 17:43:06 +0000 (Mon, 05 Oct 2026)
New Revision: 4c1a74b64f
https://github.com/ruby/ruby/commit/4c1a74b64f
Log:
fix out-of-bounds read in strftime %Z zone name copy
strlcpy returns the length of the source string, not the number of bytes it wrote into tbuf, so reusing its return value as the length for the following memcpy and case_conv lets a zone abbreviation longer than the buffer read past it. clamp it to TBUFSIZE-1 to match what was actually copied.
Modified files:
strftime.c
test/ruby/test_time.rb
New Revision: 4c1a74b64f
https://github.com/ruby/ruby/commit/4c1a74b64f
Log:
fix out-of-bounds read in strftime %Z zone name copy
strlcpy returns the length of the source string, not the number of bytes it wrote into tbuf, so reusing its return value as the length for the following memcpy and case_conv lets a zone abbreviation longer than the buffer read past it. clamp it to TBUFSIZE-1 to match what was actually copied.
Modified files:
strftime.c
test/ruby/test_time.rb
Reply all
Reply to author
Forward
0 new messages