Clamp io_reader copy to the buffer libyaml provides

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

io_reader registers as libyaml's read handler, calls IO#read(size), and copies the returned string into a fixed-capacity buffer. It copied the full returned length instead of the requested size, so an IO whose #read returns more bytes than asked for overruns the buffer.

This is a heap out-of-bounds write reachable from Psych.load and similar methods. Standard readers like StringIO honour the size limit, and only a custom IO that over-returns hits
this.

This change clamps the copy to the requested size.

[Copilot]

Pull request overview

Fixes a memory-safety issue in Psych’s libyaml IO read handler by ensuring the copy into libyaml’s fixed-capacity buffer never exceeds the size libyaml requested, even if a non-conforming IO returns more bytes than asked for. This prevents a heap out-of-bounds write reachable via Psych.load and related APIs when parsing from an IO-like object.

Changes:

• Clamp the number of bytes copied from the Ruby string returned by IO#read(size) to size in io_reader.
• Add a regression test using an IO-like object whose #read intentionally over-returns to ensure parsing does not overflow and still produces expected events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
ext/psych/psych_parser.c	Clamp memcpy length to libyaml-provided buffer size to prevent OOB writes when #read over-returns.
test/psych/test_parser.rb	Add regression test exercising an over-returning IO-like object to guard against buffer overflows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.