Merge ~utkarsh/ubuntu/+source/ruby3.0:lp1982703-array-slice-invalid-memory-access into ubuntu/+source/ruby3.0:ubuntu/jammy-devel

[Utkarsh Gupta]

Hellu!

This is a fix of LP: #1982703 for ruby3.0/jammy. The PPA can be found here: https://launchpad.net/~utkarsh/+archive/ubuntu/temporary-stuff. It's a trivial fix, really.

I'd appreciate the reviews on this one. Should you have any questions or concerns, please let me know. Thank you!

[Lucas Kanashiro (lucaskanashiro)]

Thanks for this MP Utkarsh! LGTM, I suggested some tiny changes in the DEP-3 headers of the patch.

review: Approve

[Utkarsh Gupta (utkarsh)]

Thanks, Lucas. Fixed per your suggestions. ;)

..and uploaded:

$ dput ubuntu ../ruby3.0_3.0.2-7ubuntu2.2_source.changes
Checking signature on .changes
gpg: ../ruby3.0_3.0.2-7ubuntu2.2_source.changes: Valid signature from 823E967606C34B96
Checking signature on .dsc
gpg: ../ruby3.0_3.0.2-7ubuntu2.2.dsc: Valid signature from 823E967606C34B96
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading ruby3.0_3.0.2-7ubuntu2.2.dsc: done.
  Uploading ruby3.0_3.0.2.orig.tar.xz: done.
  Uploading ruby3.0_3.0.2-7ubuntu2.2.debian.tar.xz: done.
  Uploading ruby3.0_3.0.2-7ubuntu2.2_source.buildinfo: done.
  Uploading ruby3.0_3.0.2-7ubuntu2.2_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 442db73..db66622 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ruby3.0 (3.0.2-7ubuntu2.2) jammy; urgency=medium
+
+  * d/p/fix-length-calc-for-Array#slice.patch: Add patch to
+    fix length calculation for Array#slice!. (LP: #1982703)
+
+ -- Utkarsh Gupta <[e-mail]>  Mon, 14 Nov 2022 17:21:06 +0530
+
 ruby3.0 (3.0.2-7ubuntu2.1) jammy-security; urgency=medium
 
   * SECURITY UPDATE: Double free
diff --git a/debian/patches/fix-length-calc-for-Array#slice.patch b/debian/patches/fix-length-calc-for-Array#slice.patch
new file mode 100644
index 0000000..02a039d
--- /dev/null
+++ b/debian/patches/fix-length-calc-for-Array#slice.patch
@@ -0,0 +1,29 @@
+From d9bc7b94ea9e8794da62e45269b5c3e0c11edaf4 Mon Sep 17 00:00:00 2001
+From: Mike Dalessio <[e-mail]>
+Date: Sat, 28 Aug 2021 10:29:17 -0400
+Subject: [PATCH] Fix length calculation for Array#slice!
+
+Commit 4f24255 introduced a bug which allows a length to be passed to
+rb_ary_new4 which is too large, resulting in invalid memory access.
+
+For example:
+
+    (1..1000).to_a.slice!(-2, 1000)
+
+Origin: upstream, https://github.com/ruby/ruby/commit/d43279edacd09edf3a43e02d62f5be475e7c3bcb
+Bug: https://bugs.ruby-lang.org/issues/18138
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ruby3.0/+bug/1982703
+Applied-Upstream: v3_2_0_preview3, commit:d43279edacd09edf3a43e02d62f5be475e7c3bcb
+Last-Updated: 2022-11-11
+
+--- a/array.c
++++ b/array.c
+@@ -4072,7 +4072,7 @@
+     else if (orig_len < pos) {
+         return Qnil;
+     }
+-    else if (orig_len < pos + len) {
++    if (orig_len < pos + len) {
+         len = orig_len - pos;
+     }
+     if (len == 0) {
diff --git a/debian/patches/series b/debian/patches/series
index eeda34a..139a256 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -19,3 +19,4 @@ CVE-2021-41817-3.patch
 CVE-2021-41819.patch
 CVE-2022-28738.patch
 CVE-2022-28739.patch
+fix-length-calc-for-Array#slice.patch