### Summary `Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls `doc.close` or `d.close`, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. ### Version - **Software**: oj gem - **Affected**: all versions with `ext/oj/fast.c` - **Latest tested**: 3.17.1 (confirmed present) ### Details The iterators in `ext/oj/fast.c` follow the pattern: ```c // fast.c:1505 (doc_each_child) static VALUE doc_each_child(VALUE self, ...) { ... while (cur != NULL) { rb_yield(...); // ← Ruby block executes here cur = cur->next; // ← cur is now freed if block called close() } } ``` `rb_yield` can invoke arbitrary Ruby code, including calling `close()` on the `Doc` or any child node, which calls `ruby_sized_xfree` on the backing buffer. On return, the C code reads `cur->next` from the freed region. All three iterators are affected. ASAN report (each_child variant): ``` ==253632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000bd080 READ of size 8 at 0x5210000bd080 thread T0 #0 doc_each_child /ext/oj/fast.c:1505 0x5210000bd080 is located 896 bytes inside of 4064-byte region [0x5210000bcd00, 0x5210000bdce0) freed by thread T0 here: #0 free #1 ruby_sized_xfree (libruby-3.3.so.3.3) ``` All three iterators trigger the same freed region (`fd` shadow bytes): ``` 0x5210000bd080:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd ``` ### Reproduce ```ruby require 'oj' # each_child Oj::Doc.open('[1,2]') { |doc| doc.each_child { |d| d.close } } # each_value Oj::Doc.open('[1,2]') { |doc| doc.each_value { |v| doc.close } } # each_leaf Oj::Doc.open('[1,[2]]') { |doc| doc.each_leaf { |d| d.close } } ```
### Summary `Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls `doc.close` or `d.close`, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. ### Version - **Software**: oj gem - **Affected**: all versions with `ext/oj/fast.c` - **Latest tested**: 3.17.1 (confirmed present) ### Details The iterators in `ext/oj/fast.c` follow the pattern: ```c // fast.c:1505 (doc_each_child) static VALUE doc_each_child(VALUE self, ...) { ... while (cur != NULL) { rb_yield(...); // ← Ruby block executes here cur = cur->next; // ← cur is now freed if block called close() } } ``` `rb_yield` can invoke arbitrary Ruby code, including calling `close()` on the `Doc` or any child node, which calls `ruby_sized_xfree` on the backing buffer. On return, the C code reads `cur->next` from the freed region. All three iterators are affected. ASAN report (each_child variant): ``` ==253632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000bd080 READ of size 8 at 0x5210000bd080 thread T0 #0 doc_each_child /ext/oj/fast.c:1505 0x5210000bd080 is located 896 bytes inside of 4064-byte region [0x5210000bcd00, 0x5210000bdce0) freed by thread T0 here: #0 free #1 ruby_sized_xfree (libruby-3.3.so.3.3) ``` All three iterators trigger the same freed region (`fd` shadow bytes): ``` 0x5210000bd080:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd ``` ### Reproduce ```ruby require 'oj' # each_child Oj::Doc.open('[1,2]') { |doc| doc.each_child { |d| d.close } } # each_value Oj::Doc.open('[1,2]') { |doc| doc.each_value { |v| doc.close } } # each_leaf Oj::Doc.open('[1,[2]]') { |doc| doc.each_leaf { |d| d.close } } ```
Update oj to 3.17.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOj: Use-After-Free in Oj::Doc Iterators via Reentrant Close affects oj (rubygems). Severity is high. ### Summary `Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls `doc.close` or `d.close`, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. ### Version - **Software**: oj gem - **Affected**: all versions with `ext/oj/fast.c` - **Latest tested**: 3.17.1 (confirmed present) ### Details The iterators in `ext/oj/fast.c` follow the pattern: ```c // fast.c:1505 (doc_each_child) static VALUE doc_each_child(VALUE self, ...) { ... while (cur != NULL) { rb_yield(...); // ← Ruby block executes here cur = cur->next; // ← cur is now freed if block called close() } } ``` `rb_yield` can invoke arbitrary Ruby code, including calling `close()` on the `Doc` or any child node, which calls `ruby_sized_xfree` on the backing buffer. On return, the C code reads `cur->next` from the freed region. All three iterators are affected. ASAN report (each_child variant): ``` ==253632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000bd080 READ of size 8 at 0x5210000bd080 thread T0 #0 doc_each_child /ext/oj/fast.c:1505 0x5210000bd080 is located 896 bytes inside of 4064-byte region [0x5210000bcd00, 0x5210000bdce0) freed by thread T0 here: #0 free #1 ruby_sized_xfree (libruby-3.3.so.3.3) ``` All three iterators trigger the same freed region (`fd` shadow bytes): ``` 0x5210000bd080:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd ``` ### Reproduce ```ruby require 'oj' # each_child Oj::Doc.open('[1,2]') { |doc| doc.each_child { |d| d.close } } # each_value Oj::Doc.open('[1,2]') { |doc| doc.each_value { |v| doc.close } } # each_leaf Oj::Doc.open('[1,[2]]') { |doc| doc.each_leaf { |d| d.close } } ```
AI coding agents often install or upgrade packages automatically in rubygems. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| ojrubygems | <3.17.2 | 3.17.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate oj to 3.17.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOj: Use-After-Free in Oj::Doc Iterators via Reentrant Close affects oj (rubygems). Severity is high. ### Summary `Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls `doc.close` or `d.close`, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. ### Version - **Software**: oj gem - **Affected**: all versions with `ext/oj/fast.c` - **Latest tested**: 3.17.1 (confirmed present) ### Details The iterators in `ext/oj/fast.c` follow the pattern: ```c // fast.c:1505 (doc_each_child) static VALUE doc_each_child(VALUE self, ...) { ... while (cur != NULL) { rb_yield(...); // ← Ruby block executes here cur = cur->next; // ← cur is now freed if block called close() } } ``` `rb_yield` can invoke arbitrary Ruby code, including calling `close()` on the `Doc` or any child node, which calls `ruby_sized_xfree` on the backing buffer. On return, the C code reads `cur->next` from the freed region. All three iterators are affected. ASAN report (each_child variant): ``` ==253632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000bd080 READ of size 8 at 0x5210000bd080 thread T0 #0 doc_each_child /ext/oj/fast.c:1505 0x5210000bd080 is located 896 bytes inside of 4064-byte region [0x5210000bcd00, 0x5210000bdce0) freed by thread T0 here: #0 free #1 ruby_sized_xfree (libruby-3.3.so.3.3) ``` All three iterators trigger the same freed region (`fd` shadow bytes): ``` 0x5210000bd080:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd ``` ### Reproduce ```ruby require 'oj' # each_child Oj::Doc.open('[1,2]') { |doc| doc.each_child { |d| d.close } } # each_value Oj::Doc.open('[1,2]') { |doc| doc.each_value { |v| doc.close } } # each_leaf Oj::Doc.open('[1,[2]]') { |doc| doc.each_leaf { |d| d.close } } ```
AI coding agents often install or upgrade packages automatically in rubygems. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| ojrubygems | <3.17.2 | 3.17.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard