Response by Ruby team: “severe but usual bug, not a vulnerability.”
Fixed in https://github.com/ruby/ruby/commit/58e8c9c895cc21473d6e46978666016a6e627d5f
Setting a very high precision in the date_strftime_with_tmx()
function,
the following check (in the STRFTIME
macro in date_strftime.c) will not
work as expected if s
>= 0x80000000
.
124 if (start + maxsize < s + precision) { \ 125 errno = ERANGE; \ 126 return 0; \ 127 }
This code causes a crash on my 32 bit system:
require 'date' DateTime.now.strftime("%2147483647c")
64 bit is probably not affected (technically possible, but
unlikely).