Skip to content

Is it intentional that #partial_value calls on_load?#1016

Merged
byroot merged 1 commit into
ruby:masterfrom
mame:fix-partial-value-uaf
Jun 18, 2026
Merged

Is it intentional that #partial_value calls on_load?#1016
byroot merged 1 commit into
ruby:masterfrom
mame:fix-partial-value-uaf

Conversation

@mame

@mame mame commented Jun 18, 2026

Copy link
Copy Markdown
Member

Currently #partial_value sometimes calls on_load. Is this intentional?

If it is, the in_use lock has to cover #partial_value too: otherwise touching the parser from within on_load triggers a use-after-free.

require "json"
parser = nil
parser = JSON::ResumableParser.new(on_load: ->(o) {
  parser.parse if o.is_a?(Array) # re-entrant
  o
})
parser << "[1,"
parser.parse
parser.partial_value # AddressSanitizer: heap-use-after-free

The fix in this PR holds in_use for the duration of #partial_value, like #parse does.

Personally, #partial_value is interesting, but I am not sure it has a real use case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@byroot

byroot commented Jun 18, 2026

Copy link
Copy Markdown
Member

Currently #partial_value sometimes calls on_load. Is this intentional?

It is yes.

@byroot byroot merged commit e5fa06a into ruby:master Jun 18, 2026
42 checks passed
@mame mame deleted the fix-partial-value-uaf branch June 18, 2026 17:18
@mame

mame commented Jun 18, 2026

Copy link
Copy Markdown
Member Author

I was wondering what would happen if incomplete data were passed to create_additions via on_load, but it turns out ResumableParser doesn't support create_additions at all. I think that's fine then.

By the way, passing keyword arguments like create_additions: to ResumableParser.new silently ignores them, which might be a little confusing.

@byroot

byroot commented Jun 18, 2026

Copy link
Copy Markdown
Member

passing keyword arguments like create_additions: to ResumableParser.new silently ignores them, which might be a little confusing.

Yes, it's because like all of JSON, there is actually no keyword arguments, it's all option hashes.

I would like to transition to keyword arguments for all of JSON, but I think that's something for 3.0.

But perhaps Resumable should already use keyword arguments. I'll think about it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants