[ruby-core:119257] [Ruby master Bug#20755] IO::Buffer#transfer transfers mutable reference to String's memory but not lock ownership

Issue #20755 has been reported by hanazuki (Kasumi Hanazuki).

----------------------------------------
Bug #20755: IO::Buffer#transfer transfers mutable reference to String's memory but not lock ownership
https://bugs.ruby-lang.org/issues/20755

* Author: hanazuki (Kasumi Hanazuki)
* Status: Open
* ruby -v: ruby 3.4.0dev (2024-09-18T02:16:22Z master 4797b0704a) +PRISM [x86_64-linux]
* Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN
----------------------------------------
`IO::Buffer.for` with a block yields a mutable IO::Buffer that shares underlying memory with a mutable String. While the block is executed, the String instance is temporarily locked and cannot be modified or frozen.
If you call `#transfer` on the yielded IO::Buffer in the block, however, a mutable IO::Buffer can be escaped from the `.for` method. Through this IO::Buffer instance, you can modify the underlying String memory even after the String instance is frozen.

```irb
irb(main):001> str = +'a'
=> "a"
irb(main):002> buf = IO::Buffer.for(str) {|b| b.transfer }
=>
#<IO::Buffer 0x00007f244d1ede98+1 EXTERNAL SLICE>
...
irb(main):003> str.freeze
=> "a"
irb(main):004> buf.set_string('b')
=> 1
irb(main):005> str
=> "b"
```




-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/