A simple repo case for a bug in the Ruby SDK CipherIO class.

CipherIO bug case

require 'aws-sdk'
require 'openssl'

class DotStream

  def initialize(size)
    @size = size
    @bytes_left = size
  end

  attr_reader :size

  def read(bytes = nil, output_buffer = nil)
    data = if bytes
      eof? ? nil : read_chunk(bytes)
    else
      eof? ? ""  : read_chunk(@bytes_left)
    end
    output_buffer ? output_buffer.replace(data || '') : data
  end

  def rewind
    @bytes_left = size
    0
  end

  def eof?
    @bytes_left == 0
  end

  private

  def read_chunk(bytes)
    data = '.' * [bytes, @bytes_left].min
    @bytes_left -= data.bytesize
    data
  end

end

cipher = OpenSSL::Cipher.new("AES-256-ECB")
cipher.encrypt
cipher.key = OpenSSL::Cipher.new("AES-256-ECB").random_key

# ~ 200GB stream
stream = DotStream.new(202260596110)

io = AWS::S3::CipherIO.new(cipher, stream, stream.size)

part_size = 20226060

io.read(part_size).bytesize # 20226060 -> good
io.read(part_size).bytesize # 5 -> oops!
io.eof? # true -- not true, it lies!!