From: "peterzhu2118 (Peter Zhu) via ruby-core" <ruby-core@...>
Date: 2026-09-15T02:45:18+00:00
Subject: [ruby-core:126722] [Ruby Bug#22315] heap-use-after-free in String unpack with a block that mutates the receiver

Issue #22315 has been updated by peterzhu2118 (Peter Zhu).

Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for the bug report. I was able to reproduce this issue under ASAN and able to trigger a crash even without ASAN by increasing the size of the string `s`. I have [a fix here](https://github.com/ruby/ruby/pull/18838) and I've requested backports for Ruby 3.4 and 4.0.

----------------------------------------
Bug #22315: heap-use-after-free in String unpack with a block that mutates the receiver
https://bugs.ruby-lang.org/issues/22315#change-119019

* Author: danielchong (Daniel Chong)
* Status: Open
* ruby -v: 4.1.0-dev
* Backport: 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED
----------------------------------------
PoC:
```
s = "C" * 4000
s.unpack("L*") { s.clear }
```

Asan (truncated):
```
ERROR: AddressSanitizer: heap-use-after-free on address 0x... 
READ of size 4 ... thread T0
    #3 bary_unpack_internal   bignum.c:1179
    #4 rb_integer_unpack      bignum.c:3753
    #5 pack_unpack_internal   pack.c:1415        <-- USE
0x... is located 4 bytes inside of 4001-byte region [...]
freed by thread T0 here:
    #2 ruby_xfree_sized       gc.c:6295
    #3 str_discard            string.c:2840
    #4 rb_str_clear           string.c:6678
    ...
    #16 rb_yield              vm_eval.c
    #17 pack_unpack_internal  pack.c:1416         <-- FREE (user block via rb_yield)
```






-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/