From b49b1d76d116c4262819a86ca51cb6df19304b9f Mon Sep 17 00:00:00 2001
From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Mon, 26 Aug 2019 16:09:14 +0000
Subject: merge revision(s) 9dec4e8fc3a6018261834b5ac9b9877f787b97ca: [Backport
 #15934] 	String#b: Don't depend on dependent string

	Registering a string that depend on a dependent string as fstring
	can lead to use-after-free. See c06ddfe and 3f95620 for details.

	The following script triggers use-after-free on trunk, 2.4.6, 2.5.5
	and 2.6.3. Credits to @wanabe for using eval as a cross-version way
	of registering a fstring.

	```ruby
	a = ('j' * 24).b.b
	eval('', binding, a)

	p a
	4.times { GC.start }
	p a
	```

	- string.c (str_replace_shared_without_enc): when given a
	  dependent string, depend on the root of the dependent
	  string.

	[Bug #15934]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67767 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 test/ruby/test_string.rb | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'test/ruby/test_string.rb')

diff --git a/test/ruby/test_string.rb b/test/ruby/test_string.rb
index d4303e87c1..ae5b22c19e 100644
--- a/test/ruby/test_string.rb
+++ b/test/ruby/test_string.rb
@@ -2930,6 +2930,14 @@ CODE
     assert_equal(('a' * 24), a, '[Bug #15792]')
   end
 
+  def test_nesting_shared_b
+    a = ('j' * 24).b.b
+    eval('', binding, a)
+    assert_equal(('j' * 24), a)
+    4.times { GC.start }
+    assert_equal(('j' * 24), a, '[Bug #15934]')
+  end
+
   def test_shared_force_encoding
     s = "\u{3066}\u{3059}\u{3068}".gsub(//, '')
     h = {}
-- 
cgit v1.2.3