summaryrefslogtreecommitdiff
path: root/spec
diff options
context:
space:
mode:
authornagachika <nagachika@ruby-lang.org>2023-09-30 13:07:35 +0900
committernagachika <nagachika@ruby-lang.org>2023-09-30 13:07:35 +0900
commitd30781db4de82a891712f359d7659c9fc98cb215 (patch)
tree6b40e64a4dd19fd7b52dc40a729a02f8da3cc5ea /spec
parent9ee58b2054c1bbe722ae5a2a4ec6a750ee583220 (diff)
merge revision(s) 2214bcb70d9f9120f1f3790ca340236c8f080991: [Backport #19792]
Fix premature string collection during append Previously, the following crashed due to use-after-free with AArch64 Alpine Linux 3.18.3 (aarch64-linux-musl): ```ruby str = 'a' * (32*1024*1024) p({z: str}) ``` 32 MiB is the default for `GC_MALLOC_LIMIT_MAX`, and the crash could be dodged by setting `RUBY_GC_MALLOC_LIMIT_MAX` to large values. Under a debugger, one can see the `str2` of rb_str_buf_append() getting prematurely collected while str_buf_cat4() allocates capacity. Add GC guards so the buffer of `str2` lives across the GC run initiated in str_buf_cat4(). [Bug #19792] --- string.c | 2 ++ 1 file changed, 2 insertions(+)
Diffstat (limited to 'spec')
0 files changed, 0 insertions, 0 deletions