From: "byroot (Jean Boussier)" <noreply@...>
Date: 2021-09-18T13:45:53+00:00
Subject: [ruby-core:105342] [Ruby master Bug#18141] Marshal load with proc yield strings before they are fully initialized

Issue #18141 has been updated by byroot (Jean Boussier).


I made a followup patch: https://github.com/ruby/ruby/pull/4866

It now handle similar bugs with `Array`, `Hash` and other mutable objects. It also handle circular objects.

----------------------------------------
Bug #18141: Marshal load with proc yield strings before they are fully initialized 
https://bugs.ruby-lang.org/issues/18141#change-93756

* Author: byroot (Jean Boussier)
* Status: Closed
* Priority: Normal
* Backport: 2.6: REQUIRED, 2.7: REQUIRED, 3.0: REQUIRED
----------------------------------------
I assume this is a bug because I can't find any spec or test for this behaviour:

Consider the following script:
```ruby
payload = Marshal.dump("foo")

Marshal.load(payload, -> (obj) {
  if obj.is_a?(String)
    p [obj, obj.encoding]
  end
  obj
})
p [:final, string, string.encoding]
```

outputs:
```ruby
["foo", #<Encoding:ASCII-8BIT>]
[:final, "foo", #<Encoding:UTF-8>]
```

So `Marshal` call the proc before the string get its encoding assigned, this is because the encoding is stored alongside as a `TYPE_IVAR`. I think in such cases `Marshal` should delay calling the proc until the object is fully restored.

A corollary to this behaviour is that the following code:

```ruby
Marshal.load(payload, :freeze.to_proc)
```

raises with `can't modify frozen String: "foo" (FrozenError)`.




-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>