From: "nagachika (Tomoyuki Chikanaga) via ruby-core" Date: 2026-09-20T06:31:37+00:00 Subject: [ruby-core:126802] [Ruby Bug#22315] heap-use-after-free in String unpack with a block that mutates the receiver Issue #22315 has been updated by nagachika (Tomoyuki Chikanaga). ruby_3_4 commit:ce5cca10a5143da2ccea33a53190e39a6b923241 merged revision(s) commit:685144e3d60513ccde1c6cb4bed20597cb860002. ---------------------------------------- Bug #22315: heap-use-after-free in String unpack with a block that mutates the receiver https://bugs.ruby-lang.org/issues/22315#change-119110 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED ---------------------------------------- PoC: ``` s = "C" * 4000 s.unpack("L*") { s.clear } ``` Asan (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free on address 0x... READ of size 4 ... thread T0 #3 bary_unpack_internal bignum.c:1179 #4 rb_integer_unpack bignum.c:3753 #5 pack_unpack_internal pack.c:1415 <-- USE 0x... is located 4 bytes inside of 4001-byte region [...] freed by thread T0 here: #2 ruby_xfree_sized gc.c:6295 #3 str_discard string.c:2840 #4 rb_str_clear string.c:6678 ... #16 rb_yield vm_eval.c #17 pack_unpack_internal pack.c:1416 <-- FREE (user block via rb_yield) ``` -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/