Hiroshi SHIBATAandClaude Opus 4.8 770ccaa6fb [ruby/psych] Clamp io_reader copy to libyaml's buffer size ...

io_reader trusted IO#read to honour its size argument and copied
RSTRING_LEN(string) bytes into libyaml's fixed-capacity buffer. An
IO-like object whose #read over-returns wrote past the buffer end, a
heap out-of-bounds write reachable from Psych.load/safe_load/parse.
Clamp the copied length to the requested size.

https://github.com/ruby/psych/commit/99ecd94560

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-02 02:10:54 +00:00

..

-test-

st.c: Store st_table->bins at the end of st_table->entries

2026-05-17 23:54:19 +03:00

cgi/escape

[ruby/cgi] Fix mixed declarations and code

2025-11-26 06:50:54 +00:00

continuation

Update dependencies for addition of set.h to public headers

2025-07-11 15:24:23 +09:00

coverage

[DOC] Improve docs for Coverage.start

2026-02-02 17:09:07 -05:00

date

[ruby/date] Verify all argument classes first

2026-05-29 04:21:36 +00:00

digest

[ruby/digest] Fix -Wmaybe-uninitialized

2026-05-14 14:14:56 +00:00

erb/escape

[ruby/erb] html_escape: refactor redundant if

2025-10-13 14:48:58 +00:00

etc

[ruby/etc] Win32: Drop support for older MSVC

2025-11-19 02:31:03 +00:00

fcntl

[ruby/fcntl] Bump up to v1.3.0

2025-09-10 05:37:21 +00:00

io

[ruby/io-console] Use :nodoc: instead of :stopdoc: for internal

2026-03-23 20:38:51 +00:00

json

[ruby/json] Prevent buffer over-read when generating EOF error

2026-05-29 08:01:54 +00:00

objspace

Remove use of RTYPEDDATA_P and rbimpl_rtypeddata_p

2026-05-28 19:29:32 +09:00

openssl

[ruby/openssl] asn1: limit nesting depth in OpenSSL::ASN1.decode

2026-05-30 09:03:21 +00:00

psych

[ruby/psych] Clamp io_reader copy to libyaml's buffer size

2026-06-02 02:10:54 +00:00

pty

pty: Fix missing arguments

2026-04-01 13:20:35 +09:00

rbconfig/sizeof

Update dependencies for addition of set.h to public headers

2025-07-11 15:24:23 +09:00

ripper

Introduce RMATCH_{BEG,END,NREGS} helpers

2026-05-08 13:41:12 -07:00

rubyvm

Added depend files

2019-07-14 01:31:29 +09:00

socket

Reduce unnecessary intermediate strings

2026-05-30 22:34:14 +09:00

stringio

[ruby/stringio] Cannot read into the underlying string

2026-05-07 05:40:09 +00:00

strscan

[ruby/strscan] [Feature #21943] Add StringScanner#integer_at

2026-06-01 07:55:02 +00:00

win32

Move win32-registry from default to bundled gems

2026-02-20 13:22:25 +09:00

zlib

[ruby/zlib] Bump up to 3.2.3

2026-03-05 01:38:22 +00:00

.document

[DOC] Simplify doc setup (#16393)

2026-03-15 12:47:51 +00:00

extmk.rb

Load rubygems/platform.rb after setting up the load path

2026-02-04 16:32:55 +09:00

Setup

Update ext/Setup template files [ci skip]

2026-04-30 18:44:32 +09:00

Setup.atheos

Update ext/Setup template files [ci skip]

2026-04-30 18:44:32 +09:00

Setup.nt

Update ext/Setup template files [ci skip]

2026-04-30 18:44:32 +09:00