AIKIDO-2026-297886

TL;DR

Gem::SafeMarshal::Reader#read_integer can decode a 4-byte collection length of up to about 4.3 billion, and read_array, read_hash, read_hash_with_default_value, read_object_with_ivars, and read_object passed that length straight to Array.new, which allocates the backing store before any element is read. A crafted Marshal payload as small as 8 bytes can therefore force a huge allocation and raise NoMemoryError when RubyGems loads a gemspec. The fix introduces a read_count helper that raises LengthTooLongError when the declared count exceeds remaining input bytes, and adds the missing negative-length check in read_hash.