Add bounds check for offset.

Author: ioquatix

ext/io/event/selector/epoll.c

@@ -615,6 +615,11 @@ VALUE io_read_loop(VALUE _arguments) {
 	size_t offset = arguments->offset;
 	size_t total = 0;
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+	
 	size_t maximum_size = size - offset;
 	while (maximum_size) {
 		ssize_t result = read(arguments->descriptor, (char*)base+offset, maximum_size);
@@ -713,6 +718,11 @@ VALUE io_write_loop(VALUE _arguments) {
 		rb_raise(rb_eRuntimeError, "Length exceeds size of buffer!");
 	}
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+	
 	size_t maximum_size = size - offset;
 	while (maximum_size) {
 		ssize_t result = write(arguments->descriptor, (char*)base+offset, maximum_size);

ext/io/event/selector/kqueue.c

@@ -605,6 +605,11 @@ VALUE io_read_loop(VALUE _arguments) {
 
 	if (DEBUG_IO_READ) fprintf(stderr, "io_read_loop(fd=%d, length=%zu)\n", arguments->descriptor, length);
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+	
 	size_t maximum_size = size - offset;
 	while (maximum_size) {
 		if (DEBUG_IO_READ) fprintf(stderr, "read(%d, +%ld, %ld)\n", arguments->descriptor, offset, maximum_size);
@@ -713,6 +718,11 @@ VALUE io_write_loop(VALUE _arguments) {
 
 	if (DEBUG_IO_WRITE) fprintf(stderr, "io_write_loop(fd=%d, length=%zu)\n", arguments->descriptor, length);
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+	
 	size_t maximum_size = size - offset;
 	while (maximum_size) {
 		if (DEBUG_IO_WRITE) fprintf(stderr, "write(%d, +%ld, %ld, length=%zu)\n", arguments->descriptor, offset, maximum_size, length);

ext/io/event/selector/uring.c

@@ -710,6 +710,11 @@ VALUE IO_Event_Selector_URing_io_read(VALUE self, VALUE fiber, VALUE io, VALUE b
 	size_t total = 0;
 	off_t from = io_seekable(descriptor);
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+	
 	size_t maximum_size = size - offset;
 
 	// Are we performing a non-blocking read?
@@ -775,6 +780,11 @@ VALUE IO_Event_Selector_URing_io_pread(VALUE self, VALUE fiber, VALUE io, VALUE
 	size_t total = 0;
 	off_t from = NUM2OFFT(_from);
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+	
 	size_t maximum_size = size - offset;
 	while (maximum_size) {
 		int result = io_read(selector, fiber, descriptor, (char*)base+offset, maximum_size, from);
@@ -892,6 +902,11 @@ VALUE IO_Event_Selector_URing_io_write(VALUE self, VALUE fiber, VALUE io, VALUE
 		rb_raise(rb_eRuntimeError, "Length exceeds size of buffer!");
 	}
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+
 	size_t maximum_size = size - offset;
 	while (maximum_size) {
 		int result = io_write(selector, fiber, descriptor, (char*)base+offset, maximum_size, from);
@@ -947,6 +962,11 @@ VALUE IO_Event_Selector_URing_io_pwrite(VALUE self, VALUE fiber, VALUE io, VALUE
 		rb_raise(rb_eRuntimeError, "Length exceeds size of buffer!");
 	}
 
+	// Ensure offset is within the bounds of the buffer to avoid size_t underflow and out-of-bounds pointer arithmetic on (char *)base + offset.
+	if (offset > size) {
+		return rb_fiber_scheduler_io_result(-1, EINVAL);
+	}
+
 	size_t maximum_size = size - offset;
 	while (maximum_size) {
 		int result = io_write(selector, fiber, descriptor, (char*)base+offset, maximum_size, from);

lib/io/event/selector/select.rb

@@ -188,6 +188,11 @@ def io_select(readable, writable, priority, timeout)
 			# @parameter length [Integer] The minimum number of bytes to read.
 			# @parameter offset [Integer] The offset into the buffer to read to.
 			def io_read(fiber, io, buffer, length, offset = 0)
+				# Ensure offset is within the bounds of the buffer to avoid ArgumentError
+				if offset > buffer.size
+					return -Errno::EINVAL::Errno
+				end
+				
 				total = 0
 
 				Selector.nonblock(io) do
@@ -218,6 +223,11 @@ def io_read(fiber, io, buffer, length, offset = 0)
 			# @parameter length [Integer] The minimum number of bytes to write.
 			# @parameter offset [Integer] The offset into the buffer to write from.
 			def io_write(fiber, io, buffer, length, offset = 0)
+				# Ensure offset is within the bounds of the buffer to avoid ArgumentError
+				if offset > buffer.size
+					return -Errno::EINVAL::Errno
+				end
+				
 				total = 0
 
 				Selector.nonblock(io) do

releases.md

@@ -1,5 +1,9 @@
 # Releases
 
+## Unreleased
+
+  - Add bounds checks, in the unlikely event of a user providing an invalid offset that exceeds the buffer size. This prevents potential memory corruption and ensures safe operation when using buffered IO methods.
+
 ## v1.14.4
 
   - Allow `epoll_pwait2` to be disabled via `--disable-epoll_pwait2`.

test/io/event/selector/buffered_io.rb

@@ -117,6 +117,36 @@ def be_again?
 
 			expect(result).to be_again?
 		end
+		
+		it "returns EINVAL when read offset exceeds buffer size" do
+			skip_if_ruby_platform(/mswin|mingw|cygwin/)
+			
+			buffer = IO::Buffer.new(64)
+			
+			reader = Fiber.new do
+				# Offset 128 exceeds buffer size of 64
+				result = selector.io_read(Fiber.current, input, buffer, 1, 128)
+				expect(result).to be == -Errno::EINVAL::Errno
+			end
+			
+			reader.transfer
+			selector.select(0)
+		end
+		
+		it "returns EINVAL when write offset exceeds buffer size" do
+			skip_if_ruby_platform(/mswin|mingw|cygwin/)
+			
+			buffer = IO::Buffer.new(64)
+			
+			writer = Fiber.new do
+				# Offset 128 exceeds buffer size of 64
+				result = selector.io_write(Fiber.current, output, buffer, 1, 128)
+				expect(result).to be == -Errno::EINVAL::Errno
+			end
+			
+			writer.transfer
+			selector.select(0)
+		end
 	end
 end
 

test/io/event/selector/file_io.rb

@@ -92,6 +92,52 @@
 
 			expect(wait_result).to be == IO::WRITABLE
 		end
+		
+		it "returns EINVAL when read offset exceeds buffer size" do
+			skip_if_ruby_platform(/mswin|mingw|cygwin/)
+			
+			buffer = IO::Buffer.new(64)
+			file.seek(0)
+			
+			# Offset 128 exceeds buffer size of 64
+			result = selector.io_read(Fiber.current, file, buffer, 1, 128)
+			
+			expect(result).to be == -Errno::EINVAL::Errno
+		end
+		
+		it "returns EINVAL when write offset exceeds buffer size" do
+			skip_if_ruby_platform(/mswin|mingw|cygwin/)
+			
+			buffer = IO::Buffer.new(64)
+			file.seek(0)
+			
+			# Offset 128 exceeds buffer size of 64
+			result = selector.io_write(Fiber.current, file, buffer, 1, 128)
+			
+			expect(result).to be == -Errno::EINVAL::Errno
+		end
+		
+		it "returns EINVAL when pread offset exceeds buffer size" do
+			skip "io_pread is not implemented" unless selector.respond_to?(:io_pread)
+			
+			buffer = IO::Buffer.new(64)
+			
+			# Offset 128 exceeds buffer size of 64
+			result = selector.io_pread(Fiber.current, file, buffer, 0, 1, 128)
+			
+			expect(result).to be == -Errno::EINVAL::Errno
+		end
+		
+		it "returns EINVAL when pwrite offset exceeds buffer size" do
+			skip "io_pwrite is not implemented" unless selector.respond_to?(:io_pwrite)
+			
+			buffer = IO::Buffer.new(64)
+			
+			# Offset 128 exceeds buffer size of 64
+			result = selector.io_pwrite(Fiber.current, file, buffer, 0, 1, 128)
+			
+			expect(result).to be == -Errno::EINVAL::Errno
+		end
 	end
 end