Currently, if GC is disabled, postmortem GC is not ran when a Ractor dies. This can cause the object space to have issues because we need to run the postmortem GC. This commit will guarantee that it runs.peterzhu2118 (Peter Zhu)
If the format string is modified during Array#pack (by conversion such as to_str, to_int, etc.), it can cause an use-after-free since reading p[-1] may be an use-after-free. We should read that byte before performing the conversion. The...peterzhu2118 (Peter Zhu)
For strings larger than or equal to IO_BUFFER_BLOCKING_SIZE (which is 1KB), IO::Buffer#set_string will perform the memmove without GVL. In this time, another thread can resize the IO::Buffer object. In that case, the buffer may be freed ...peterzhu2118 (Peter Zhu)
When the string buffer reaches BUFSIZ (8192 bytes), Marshal.dump will call the write method on the IO object. This IO object can run arbitrary Ruby code. If the object is a string, it writes the length of the string followed by the bytes...peterzhu2118 (Peter Zhu)
If the source string is modified in the block of String#unpack, it can cause an use-after-free. For example, the following script crashes: fmt = "A" * 1_000_000 str = "C" * 1_000_000 str.unpack(fmt) { fmt.clear }peterzhu2118 (Peter Zhu)
The precision in Time.new calls to_int which can modify the string passed into Time.new. This can cause an use-after-free. For example, the following script crashes: str = "2000-01-01 00:00:00" + "0" * 1_000_000 obj = Object.new...peterzhu2118 (Peter Zhu)
peterzhu2118 (Peter Zhu)01:02 PM Ruby Revision 6eab8427 (git): Force postmortem GC to always run