Skip to content

Raise for a scalar too long for libyaml - #829

Open
mame wants to merge 1 commit into
ruby:masterfrom
mame:emitter-length-check
Open

mame wants to merge 1 commit into
ruby:masterfrom
mame:emitter-length-check

Conversation

@mame

@mame mame commented Nov 9, 2026

Copy link
Copy Markdown
Member

Psych::Emitter#scalar truncates the length of the scalar to int.

require "psych"

s = "a" * (2**32 - 1)
e = Psych::Emitter.new(File.open(File::NULL, "w"))
e.start_stream(Psych::Parser::UTF8)
e.start_document([], [], true)
e.scalar(s, nil, nil, true, false, Psych::Nodes::Scalar::ANY)
# expected: RangeError
# actual:   [BUG] Segmentation fault

The length of a scalar was cast to int when passed to libyaml, so a string of 2 GiB or longer was truncated or made libyaml copy a wrong length. Use RSTRING_LENINT, which raises for such a string.

The length of a scalar was cast to int when passed to libyaml, so a
string of 2 GiB or longer was truncated or made libyaml copy a wrong
length.  Use RSTRING_LENINT, which raises for such a string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant