Hello Simon,
On 02/10/2026 18:15, Simon Quigley wrote:
Yes, a few of them are worth fixing on Bookworm. Not the whole 3.17.5
update, and I wouldn't ship a Bookworm update while Trixie still has the
same bugs, but some issues are still worth fixing.
I ran some tests on ruby-oj 3.14.2-1+deb12u1.
These are the ones I'd look at:
- An empty "^m" segfaults.
- So does a key of exactly 65536 bytes that starts with ":". The 65537-
byte key from the new test doesn't, and a plain 65536-byte key doesn't
either. Both come back with an empty key.
- Float::DIG by itself is a TypeError on this Ruby. Float::DIG::X
segfaults, class cache on or off.
- :create_id => nil double-frees, once the default create_id has been
changed.
- Indent 8 at 40 levels and indent 16 at 30 levels abort with
"realloc(): invalid next size". I ran both again and they failed every
time. Indent 2 and 4 were fine out to 50. Those two indents are still
allowed.
I wouldn't do a DLA for the rest:
[snip!]
The Trixie package still has the code behind each of these crashes,
plus :float_format, so I don't want Bookworm to go out on its own. If
the Security Team wants another Trixie DSA, Bookworm should follow that.
If not, would a followup Trixie point release make sense as well, with
the same small set?
Thanks for these details :)
Ideally, could you coordinate with upstream to issue a few CVEs/GHSAs
for the important issues you short-listed? This would make it easier to
coordinate with the Security Team, and also benefit other downstreams.
Alternatively coordinate with the Security Team to create temporary
entries (TEMP-2026-XXXX) that they can review, so we can coordinate
trixie/bookworm.
The Security Team will then decide whether these are worth a DSA or a
SPU (point release / "no-dsa"). Once the DSA/SPU is approved, we can
follow suite for bookworm-lts.
Cheers!
Sylvain Beucler
Debian LTS Team
