If the format string is modified during Array#pack (by conversion such as to_str, to_int, etc.), it can cause an use-after-free since reading p[-1] may be an use-after-free. We should read that byte before performing the conversion. The...peterzhu2118 (Peter Zhu)
For strings larger than or equal to IO_BUFFER_BLOCKING_SIZE (which is 1KB), IO::Buffer#set_string will perform the memmove without GVL. In this time, another thread can resize the IO::Buffer object. In that case, the buffer may be freed ...peterzhu2118 (Peter Zhu)
When the string buffer reaches BUFSIZ (8192 bytes), Marshal.dump will call the write method on the IO object. This IO object can run arbitrary Ruby code. If the object is a string, it writes the length of the string followed by the bytes...peterzhu2118 (Peter Zhu)
If the source string is modified in the block of String#unpack, it can cause an use-after-free. For example, the following script crashes: fmt = "A" * 1_000_000 str = "C" * 1_000_000 str.unpack(fmt) { fmt.clear }peterzhu2118 (Peter Zhu)
The precision in Time.new calls to_int which can modify the string passed into Time.new. This can cause an use-after-free. For example, the following script crashes: str = "2000-01-01 00:00:00" + "0" * 1_000_000 obj = Object.new...peterzhu2118 (Peter Zhu)
If the Dir object is closed in the block of Dir#each/each_child/scan, then it will crash because dirp->dir will be a NULL pointer. The following script demonstrates the crash: d = Dir.open("/") d.each { d.close }peterzhu2118 (Peter Zhu)
Calling to_int on the count may run Ruby code that modifies the array. This can cause an out-of-bounds in Array#permutation. For example, the following code crashes: ary = (1..1_000).to_a obj = Object.new obj.define_singleto...peterzhu2118 (Peter Zhu)
peterzhu2118 (Peter Zhu)08:54 AM Ruby Revision 413145a2 (git): Fix crash in Array#pack when format string modified