Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.

Affected: RubyGems: oj

### Summary

`Oj.load` in `:object` mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory.

### Details

In `ext/oj/intern.c`, `form_attr()` handles the long-key path by allocating a heap buffer `b`, populating it with the attribute name, and then freeing it — but it passed the **uninitialized stack buffer `buf`** (not `b`) to `rb_intern3()`:

```c static VALUE form_attr(const char *str, size_t len) { char buf[256]; if (sizeof(buf) - 2 <= len) { // long-key path (len >= 254) char *b = OJ_R_ALLOC_N(char, len + 2); // ... b is filled correctly ... id = rb_intern3(buf, len + 1, oj_utf8_encoding); // BUG: reads `buf` OJ_R_FREE(b); return id; } // ... } ```

`rb_intern3` therefore reads `len + 1` bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte `buf` (CWE-125). The resulting bytes are interned and can reach the caller via the produced Symbol or via the `EncodingError` message raised on invalid UTF-8, leaking process stack contents.

This is the same defect previously fixed in `ext/oj/usual.c`; `intern.c` held a duplicated copy of `form_attr` that was missed.

### Proof of Concept

```ruby require 'oj' key = "A" * 300 json = %Q[{"^o":"Object","#{key}":1}] Oj.load(json, mode: :object) ```

O…

Affected: Ubuntu:14.04:LTS: ruby-oj, Ubuntu:16.04:LTS: ruby-oj, Ubuntu:18.04:LTS: ruby-oj, Ubuntu:20.04:LTS: ruby-oj, Ubuntu:22.04:LTS: ruby-oj, Ubuntu:24.04:LTS: ruby-oj, Ubuntu:25.10: ruby-oj, Ubuntu:26.04:LTS: ruby-oj

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.