Ruby Issue Tracking System

09/23/2026

10:00 AM Ruby Revision 4a71c493 (git): [ruby/mmtk] Bump to Rust 2024 edition

https://github.com/ruby/mmtk/commit/2801d95aa4 peterzhu2118 (Peter Zhu)

05:53 AM Ruby Revision 852b2434 (git): Fix use-after-free in String#unpack

If the source string is modified in the block of String#unpack, it can
cause an use-after-free. For example, the following script crashes:
fmt = "A" * 1_000_000
str = "C" * 1_000_000
str.unpack(fmt) { fmt.clear } peterzhu2118 (Peter Zhu)

12:36 AM Ruby Revision bb382ae5 (git): Fix use-after-free in Time.new when string modified

The precision in Time.new calls to_int which can modify the string passed
into Time.new. This can cause an use-after-free. For example, the following
script crashes:
str = "2000-01-01 00:00:00" + "0" * 1_000_000
obj = Object.new... peterzhu2118 (Peter Zhu)

09/22/2026

07:03 AM Ruby Revision d41370ae (git): Fix crash in Dir#each/each_child/scan when closed

If the Dir object is closed in the block of Dir#each/each_child/scan, then
it will crash because dirp->dir will be a NULL pointer. The following
script demonstrates the crash:
d = Dir.open("/")
d.each { d.close } peterzhu2118 (Peter Zhu)

03:10 AM Ruby Revision 1007084e (git): Fix out-of-bounds in Array#permutation when array modified

Calling to_int on the count may run Ruby code that modifies the array.
This can cause an out-of-bounds in Array#permutation. For example, the
following code crashes:
ary = (1..1_000).to_a
obj = Object.new
obj.define_singleto... peterzhu2118 (Peter Zhu)

09/21/2026

11:54 PM Ruby Revision 88bfa300 (git): Fix buffer overflow in String#rpartition

The conversion of the pattern to string can cause the string to be modified.
This can cause a buffer overflow since it uses the original length of the
string. For example, the following script reports a buffer overflow with
ASAN:
s ... peterzhu2118 (Peter Zhu)

04:59 PM Ruby Revision 1f717ae3 (git): [ruby/mmtk] Always use fixed heap for testing against NoGC

https://github.com/ruby/mmtk/commit/3f94f904eb peterzhu2118 (Peter Zhu)

12:01 PM Ruby Revision eb08b745 (git): [ruby/mmtk] Keep track of pending pages in RubyHeapTrigger

We need to keep track of pending pages in RubyHeapTrigger otherwise a large
allocation may cause infinite number of GCs to be ran since it will always
appear that we have enough space in the heap (and thus the heap won't grow)
but still ... peterzhu2118 (Peter Zhu)

06:29 AM Ruby Revision d4d07867 (git): Fix out-of-bounds access in String#byteindex/byterindex

If the source string is modified when converting offset to an integer,
then there could be an out-of-bounds access because the length of the
string is captured before to_int is called. For example, the following
script triggers an ASAN e... peterzhu2118 (Peter Zhu)

02:18 AM Ruby Revision 681d0f14 (git): Fix crash in String#tr when hash modified

String#tr can crash if keys are removed from the translation hash since
we stack allocate a buffer pairs. If entries are deleted during runtime,
then we won't fill the pairs buffer which can crash because it will be
reading uninitialized... peterzhu2118 (Peter Zhu)