[Impact]
========
The array.c functions rb_ary_slice_bang / ary_slice_bang_by_rb_ary_splice allow a length to be passed to rb_ary_new4 that is too long and which leads to an invalid memory access. This has been fixed in Kinetic (and forward) and isn't present in releases before Jammy. So Jammy is all that's left to fix.
[Test Plan]
===========
$ lxc launch images:ubuntu/jammy jtemp --vm
$ lxc shell jtemp
# apt update && apt install valgrind ruby3.0
# echo '(1..5000).to_a.slice!(-2, 5000)' > lp1982703.rb
# valgrind ruby lp1982703.rb |& tee lp1982703.valgrind
# grep "Invalid read of size 8" -A4 lp1982703.valgrind
You'll see:
```
==228628== Invalid read of size 8
==228628== at 0x48428C0: memmove (vg_replace_strmem.c:1271)
==228628== by 0x356542: ary_memcpy (array.c:316)
==228628== by 0x356542: rb_ary_tmp_new_from_values (array.c:785)
==228628== by 0x356542: rb_ary_new_from_values (array.c:795)
==228628== by 0x356542: ary_slice_bang_by_rb_ary_splice (array.c:4106)
==228628== by 0x35E1DB: rb_ary_slice_bang (array.c:4186)
```
and respective HEAP and LEAK SUMMARY.
[Where Problems Could Occur]
============================
The fix is a one-line, trivial patch which fixes the length calculation for Array#slice! by moving the respective check out of an if..elseif clause to its separate if clause - making sure it's checked always.
It's hard for things to go wrong further there because it was already resulting in an invalid memory access.
One thing that could go wrong is where people have made workarounds - for instance, instead of passing start, index values like Array#slice!(start, index), one would workaround this bug by changing that to Array#slice!(start..index). Even then, these things won't break because they're supposed to work irrespective but would be ideal to resort back to proper usage.
Thanks for taking the time to report this bug and trying to make Ubuntu better.
This is affecting kinetic and jammy. In Jammy, we need a SRU and a backport of the fix is what we need. In Kinetic, I'll see what is the best approach but maybe we should merge version 3.0.4-7 from Debian unstable.