vhulto f04511c9c2 Ruby: clamp len in RepeatedField#[beg, len] to fix out-of-bounds read (#27191) ... ## Bug `RepeatedField_subarray` (called from `RepeatedField_index` 2-arg form, `repeated_field.c:270`) loops `i` from `beg` to `beg + len` and calls `upb_Array_Get(arr, i)` for every value. `upb_Array_Get` only has a debug-only `UPB_ASSERT` (ruby-upb.c:7182); release builds therefore perform `memcpy(&ret, data + (i << lg2), 1 << lg2)` for arbitrary `i`, reading the upb arena out of bounds. Result: silent heap info disclosure for numeric fields (`repeated int32` returns adjacent arena bytes as Ruby integers), segfault for `repeated string`/`message`. Confirmed with ASAN (`use-after-poison`, READ size 4 at `RepeatedField_subarray:188`). ## Fix Clamp `len` to `size - beg` in `RepeatedField_subarray`, matching Ruby `Array#[beg, len]` semantics. Also reject negative `len` and fix the `rb_ary_new2(size)` capacity hint to use the now-known `len`. Closes #27191 COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/27191 from vhullto:fix/repeated-field-subarray-oob 876202835c PiperOrigin-RevId: 917251509		2026-05-18 08:40:57 -07:00
..
google	Ruby: clamp len in RepeatedField#[beg, len] to fix out-of-bounds read (#27191)	2026-05-18 08:40:57 -07:00
stubs	Add Ruby files for documentation purposes (#21212)	2025-06-06 19:11:48 -07:00