Ensure safe handling of IO::Buffer#hexdump width. (ruby#16593)

Author: ioquatix

io_buffer.c

@@ -39,6 +39,7 @@ size_t RUBY_IO_BUFFER_DEFAULT_SIZE;
 
 enum {
     RB_IO_BUFFER_HEXDUMP_DEFAULT_WIDTH = 16,
+    RB_IO_BUFFER_HEXDUMP_MAXIMUM_WIDTH = 1024,
 
     RB_IO_BUFFER_INSPECT_HEXDUMP_MAXIMUM_SIZE = 256,
     RB_IO_BUFFER_INSPECT_HEXDUMP_WIDTH = 16,
@@ -384,7 +385,7 @@ io_buffer_extract_size(VALUE argument)
 }
 
 // Extract a width argument, which must be a non-negative integer, and must be
-// at least the given minimum.
+// at least the given minimum and at most RB_IO_BUFFER_HEXDUMP_MAXIMUM_WIDTH.
 static inline size_t
 io_buffer_extract_width(VALUE argument, size_t minimum)
 {
@@ -398,6 +399,10 @@ io_buffer_extract_width(VALUE argument, size_t minimum)
         rb_raise(rb_eArgError, "Width must be at least %" PRIuSIZE "!", minimum);
     }
 
+    if (width > RB_IO_BUFFER_HEXDUMP_MAXIMUM_WIDTH) {
+        rb_raise(rb_eArgError, "Width must be at most %" PRIuSIZE "!", (size_t)RB_IO_BUFFER_HEXDUMP_MAXIMUM_WIDTH);
+    }
+
     return width;
 }
 

test/ruby/test_io_buffer.rb

@@ -960,4 +960,48 @@ def test_locked_throw
     refute_predicate buf, :locked?
     buf.locked { }
   end
+
+  def test_hexdump_default_width
+    buffer = IO::Buffer.for("Hello World")
+    hexdump = buffer.hexdump
+    assert_include hexdump, "Hello World"
+    assert_include hexdump, "0x00000000"
+  end
+
+  def test_hexdump_custom_width
+    buffer = IO::Buffer.for("A" * 64)
+    hexdump = buffer.hexdump(0, 64, 32)
+    assert_include hexdump, "0x00000000"
+    assert_include hexdump, "0x00000020"
+  end
+
+  def test_hexdump_maximum_width
+    buffer = IO::Buffer.for("A" * 2048)
+    # Maximum width is 1024
+    hexdump = buffer.hexdump(0, 1024, 1024)
+    assert_include hexdump, "0x00000000"
+  end
+
+  def test_hexdump_width_too_large
+    buffer = IO::Buffer.for("A")
+    # Width exceeding maximum (1024) should raise ArgumentError
+    assert_raise(ArgumentError) do
+      buffer.hexdump(0, 1, 1025)
+    end
+  end
+
+  def test_hexdump_width_negative
+    buffer = IO::Buffer.for("A")
+    assert_raise(ArgumentError) do
+      buffer.hexdump(0, 1, -1)
+    end
+  end
+
+  def test_hexdump_width_zero
+    buffer = IO::Buffer.for("A")
+    # Width must be at least 1
+    assert_raise(ArgumentError) do
+      buffer.hexdump(0, 1, 0)
+    end
+  end
 end