GHSA-x2f5-4prf-w687 — Ruby json: JSON generator heap buffer overflow when streaming to an IO

Affected: RubyGems: json

### Summary

`JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash / denial of service.

This was triaged on HackerOne as report #3785370. The issue was confirmed there and I was asked to open it here.

### Details

Root cause is in `ext/json/fbuffer/fbuffer.h`, `fbuffer_do_inc_capa()`.

On the IO path, the buffer is grown to `FBUFFER_IO_BUFFER_SIZE` (16383), but the early return checks total capacity instead of remaining capacity:

```c if (RB_UNLIKELY(fb->io)) { if (fb->capa < FBUFFER_IO_BUFFER_SIZE) { fbuffer_realloc(fb, FBUFFER_IO_BUFFER_SIZE); } else { fbuffer_flush(fb); }

if (RB_LIKELY(requested < fb->capa)) { return; } } ```

If `fb->len` already contains JSON syntax bytes, and a string flush has `16383 - fb->len <= requested < 16383`, this check returns even though there is not enough space left. `fbuffer_append_reserved()` then writes past the buffer:

```c MEMCPY(fb->ptr + fb->len, newstr, char, len); ```

The minimal fix is to compare against the remaining capacity:

```diff - if (RB_LIKELY(requested < fb->capa)) { + if (RB_LIKELY(requested <= fb->capa - fb->len)) { return; } ```

### PoC

```ruby require "json" require "stringio"

io = StringIO.new…

Most recent entries from all

GHSA-x2f5-4prf-w687 — Ruby json: JSON generator heap buffer overflow when streaming to an IO