Repository navigation
Fiddle::Pointer#[]= copies beyond the source pointer size #214
Description
require "fiddle"
include Fiddle
dst = Pointer.malloc(32, RUBY_FREE)
src = Pointer.malloc(4, RUBY_FREE)
dst[0, 32] = "\x00" * 32
src[0, 4] = "\xAA\xBB\xCC\xDD"
# src is only 4 bytes, but 16 bytes are copied.
dst[0, 16] = src
puts dst.to_str(32)
.bytes
.first(16)
.map { |b| "%02x" % b }
.join(" ")
# aa bb cc dd ad 78 00 00 d8 2a a1 98 ad 78 00 00
# (In my environment)
Activity
kojix2 commentedon Aug 13, 2026
How much safety guarding (e.g. bounds checking) to include in the design is a project policy decision. Raising the safety threshold reduces the risk of users hitting unexpected undefined behavior or memory corruption. The tradeoff is more code and more complexity, which hurts maintainability. This report is part of my personal practice of bug hunting with AI, and also a contribution to Fiddle, which I use. It is not a proposal to shift the project toward the safer side.
kou commentedon Aug 13, 2026
Let's add a boundary check for this case.