Ruby Issue Tracking System

Today

04:59 PM Ruby Revision 1f717ae3 (git): [ruby/mmtk] Always use fixed heap for testing against NoGC

https://github.com/ruby/mmtk/commit/3f94f904eb peterzhu2118 (Peter Zhu)

12:01 PM Ruby Revision eb08b745 (git): [ruby/mmtk] Keep track of pending pages in RubyHeapTrigger

We need to keep track of pending pages in RubyHeapTrigger otherwise a large
allocation may cause infinite number of GCs to be ran since it will always
appear that we have enough space in the heap (and thus the heap won't grow)
but still ... peterzhu2118 (Peter Zhu)

06:29 AM Ruby Revision d4d07867 (git): Fix out-of-bounds access in String#byteindex/byterindex

If the source string is modified when converting offset to an integer,
then there could be an out-of-bounds access because the length of the
string is captured before to_int is called. For example, the following
script triggers an ASAN e... peterzhu2118 (Peter Zhu)

02:18 AM Ruby Revision 681d0f14 (git): Fix crash in String#tr when hash modified

String#tr can crash if keys are removed from the translation hash since
we stack allocate a buffer pairs. If entries are deleted during runtime,
then we won't fill the pairs buffer which can crash because it will be
reading uninitialized... peterzhu2118 (Peter Zhu)

09/20/2026

12:06 PM Ruby Revision edce07a8 (git): Fix use-after-free in String#% when array modified

If the array object passed into String#% is modified during conversion
(such as via to_s, to_i, to_f, etc.) then it can be a use-after-free if
the buffer of the array is freed.
This commit changes it to detect if the buffer has been cha... peterzhu2118 (Peter Zhu)

01:21 AM Ruby Revision 5a4ccd91 (git): Fix use-after-free in String#each_line with separator modified

The separator can be modified in the block yielded by String#each_line.
When that happens, the pointer can change which can cause an use-after-free.
For example, the following script crashes:
sep = "x" * 1_000_000
s = "a#{sep}b#... peterzhu2118 (Peter Zhu)

09/19/2026

12:28 PM Ruby Revision 44874b7e (git): Fix use-after-free in String#strip methods

The selector conversion may run aribtrary Ruby code and modify the source
string. This can cause a use-after-free if it resizes the source string.
For example, the following script causes corruption:
s = "-" * 1000 + "abc" + "-" * 1... peterzhu2118 (Peter Zhu)

04:34 AM Ruby Bug #22336 (Closed): IO:Buffer Heap uaf

Applied in changeset commit:git|b61da996afb02715cb16703a55f57c4417fd2d5b.
----------
[Bug #22336] Fix use-after-free in `IO::Buffer#get_string`. (#18919) peterzhu2118 (Peter Zhu)

04:34 AM Ruby Revision b61da996 (git): [Bug #22336] Fix use-after-free in `IO::Buffer#get_string`. (#18919)

peterzhu2118 (Peter Zhu)

12:27 AM Ruby Bug #22326: heap buffer overflow in array.values_at()

Thank you for this bug report. I believe [this PR](https://github.com/ruby/ruby/pull/18870) should have fixed this bug. I will mark this issue for backport. peterzhu2118 (Peter Zhu)