Bug #22461: Use-after-free in `String` formatting with wide character encodings

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED

[nobu (Nobuyoshi Nakada)]

A heap use-after-free bug exists in Ruby's string formatting implementation (String#% and Kernel#sprintf) when processing wide character encoded strings.

[nobu (Nobuyoshi Nakada)]

• Description updated (diff)

[nobu (Nobuyoshi Nakada)]

GH-19472

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed

Applied in changeset git|faefcb11050ea61ee011e3b73c929ff406d30b68.

---

[Bug #22461] Fix dangling pointers after associating encoding

rb_enc_associate may re-allocate the string buffer because of the
terminator length change.