diff options
| author | nagachika <nagachika@ruby-lang.org> | 2023-09-30 13:07:35 +0900 |
|---|---|---|
| committer | nagachika <nagachika@ruby-lang.org> | 2023-09-30 13:07:35 +0900 |
| commit | d30781db4de82a891712f359d7659c9fc98cb215 (patch) | |
| tree | 6b40e64a4dd19fd7b52dc40a729a02f8da3cc5ea /spec/ruby/shared | |
| parent | 9ee58b2054c1bbe722ae5a2a4ec6a750ee583220 (diff) | |
merge revision(s) 2214bcb70d9f9120f1f3790ca340236c8f080991: [Backport #19792]
Fix premature string collection during append
Previously, the following crashed due to use-after-free
with AArch64 Alpine Linux 3.18.3 (aarch64-linux-musl):
```ruby
str = 'a' * (32*1024*1024)
p({z: str})
```
32 MiB is the default for `GC_MALLOC_LIMIT_MAX`, and the crash
could be dodged by setting `RUBY_GC_MALLOC_LIMIT_MAX` to large values.
Under a debugger, one can see the `str2` of rb_str_buf_append()
getting prematurely collected while str_buf_cat4() allocates capacity.
Add GC guards so the buffer of `str2` lives across the GC run
initiated in str_buf_cat4().
[Bug #19792]
---
string.c | 2 ++
1 file changed, 2 insertions(+)
Diffstat (limited to 'spec/ruby/shared')
0 files changed, 0 insertions, 0 deletions
