Collected research
Ruby Array Pack Bleed
A signed and unsigned mismatch in the repeat-count parsing of Ruby's Array pack makes a huge count negative, so the back-up-a-byte directive grows the packed string instead of shrinking it. The result discloses heap memory past the string buffer, including pointers, or crashes the interpreter.
Record
- Researcher
- Luke Jahnke
- Published by
- nastystereo.com
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Luke Jahnke, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .