From: "nagachika (Tomoyuki Chikanaga) via ruby-core" Date: 2026-06-29T10:11:56+00:00 Subject: [ruby-core:125874] [Ruby Bug#22101] ASAN heap-use-after-free in rb_data_free after TypedData dfree frees dynamic rb_data_type_t Issue #22101 has been updated by nagachika (Tomoyuki Chikanaga). Backport changed from 3.3: REQUIRED, 3.4: REQUIRED, 4.0: DONE to 3.3: REQUIRED, 3.4: DONE, 4.0: DONE ruby_3_4: merged the backport PR: https://github.com/ruby/ruby/pull/17268 ---------------------------------------- Bug #22101: ASAN heap-use-after-free in rb_data_free after TypedData dfree frees dynamic rb_data_type_t https://bugs.ruby-lang.org/issues/22101#change-117801 * Author: rwstauner (Randy Stauner) * Status: Closed * Backport: 3.3: REQUIRED, 3.4: DONE, 4.0: DONE ---------------------------------------- `rb_data_free` currently calls `dfree` and then evaluates `RTYPEDDATA_EMBEDDABLE_P(obj)`. Since `RTYPEDDATA_EMBEDDABLE_P(obj)` reads `RTYPEDDATA_TYPE(obj)->flags`, this can become a use-after-free if an extension's `dfree` releases a dynamically allocated `rb_data_type_t`. This was observed under ASAN with `glib2` 4.3.6, where `cinfo_free` frees `cinfo->data_type`. I have a fix that simply caches the TypedData type and the embeddable/free decision before invoking `dfree`, matching the existing pattern of caching `dfree` and `RUBY_TYPED_FREE_IMMEDIATELY` before extension cleanup code runs: https://github.com/ruby/ruby/pull/17266 This is a small defensive fix and is suitable for backport because it avoids a shutdown-time ASAN heap-use-after-free without changing TypedData ownership semantics. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/