Hi Sylvain, Yes, a few of them are worth fixing on Bookworm. Not the whole 3.17.5 update, and I wouldn't ship a Bookworm update while Trixie still has the same bugs, but some issues are still worth fixing.
I ran some tests on ruby-oj 3.14.2-1+deb12u1. These are the ones I'd look at: - An empty "^m" segfaults. - So does a key of exactly 65536 bytes that starts with ":". The 65537-byte key from the new test doesn't, and a plain 65536-byte key doesn't either. Both come back with an empty key. - Float::DIG by itself is a TypeError on this Ruby. Float::DIG::X segfaults, class cache on or off. - :create_id => nil double-frees, once the default create_id has been changed. - Indent 8 at 40 levels and indent 16 at 30 levels abort with "realloc(): invalid next size". I ran both again and they failed every time. Indent 2 and 4 were fine out to 50. Those two indents are still allowed. I wouldn't do a DLA for the rest: - Nested objects from a string were fine out to 900. Short keys are only copied into the value-stack block on a stream parse. With the normal allocator those keys stayed correct. When I forced the block to move, the same document from a StringIO came back with the wrong keys starting at depth 64 (128 of them, at a depth of 200). I had to play with the allocator to see it. - A long unknown class name just raises ArgumentError, and the message is always 126 bytes. ASan sees a one-byte stack write in oj_set_error_at when the name is 224 bytes. It doesn't crash otherwise. - A trailing backslash raises EncodingError. ASan sees a one-byte read past the end of the string, in read_escaped_str. Same story. - In :compat, 6000 colliding keys took about 28 times as long as random keys, and the second parse stayed slow. cache_keys: false was back to normal. Object mode doesn't use that cache. That's not enough on its own. The Trixie package still has the code behind each of these crashes, plus :float_format, so I don't want Bookworm to go out on its own. If the Security Team wants another Trixie DSA, Bookworm should follow that. If not, would a followup Trixie point release make sense as well, with the same small set? Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
