Ruby Issue Tracking System

07/21/2026

04:13 PM Ruby Feature #22186: Increase the embeddable size limit for substrings created by `str_subseq()`

Sounds good, I will go with that. himura467 (Akito Shitara)

03:33 PM Ruby Feature #22186: Increase the embeddable size limit for substrings created by `str_subseq()`

byroot (Jean Boussier) wrote in #note-6:
> Since the caller doesn't have control over whether Ruby will use copy or sharing, ultimately we're limited to heuristics, which by definition won't ever be perfect.
Agreed, and I should ha... himura467 (Akito Shitara)

03:21 PM Ruby Feature #22186: Increase the embeddable size limit for substrings created by `str_subseq()`

byroot (Jean Boussier) wrote in #note-6:
> This isn't always a good reflection of performance in larger benchmark / real programs.
Agreed, I looked for real libraries with the same shape as the fluentd case.
`Net::HTTPResponse#r... himura467 (Akito Shitara)

03:06 PM Ruby Feature #22186: Increase the embeddable size limit for substrings created by `str_subseq()`

byroot (Jean Boussier) wrote in #note-8:
> Another thing that could be interesting to investigate at, is why fluentd benefit so much from this change. I suspect it may be currently creating shared strings that are almost immediately uns... himura467 (Akito Shitara)

07/14/2026

01:52 PM Ruby Bug #22195: IO::Buffer read after free silently returns empty data instead of raising

PR: https://github.com/ruby/ruby/pull/17862 himura467 (Akito Shitara)

09:27 AM Ruby Bug #22195 (Open): IO::Buffer read after free silently returns empty data instead of raising

Reading from an `IO::Buffer` after calling `#free` does not raise. It behaves like an empty buffer:
```ruby
buffer = IO::Buffer.for("Hello World")
buffer.free
buffer.get_string # => "" (no error)
```
## Why this looks like an u... himura467 (Akito Shitara)

07/09/2026

11:36 PM Ruby Revision 1e04c805 (git): Fix UAF in IO::Buffer#& when self or mask is an invalidated slice

himura467 (Akito Shitara)

11:36 PM Ruby Revision 2c9f1e3a (git): Fix UAF in IO::Buffer#| when self or mask is an invalidated slice

`io_buffer_or` accessed `buffer->base` and `mask_buffer->base` directly without validating that the buffers were still live. A slice whose parent had been freed retained its stale base pointer, so calling `|` on it caused a UAF.
Use `io... himura467 (Akito Shitara)

11:36 PM Ruby Revision 03d7c7a6 (git): Fix UAF in IO::Buffer#^ when self or mask is an invalidated slice

`io_buffer_xor` accessed `buffer->base` and `mask_buffer->base` directly without validating that the buffers were still live. A slice whose parent had been freed retained its stale base pointer, so calling `^` on it caused a UAF.
Use `i... himura467 (Akito Shitara)

11:36 PM Ruby Revision 1386bb3f (git): Fix UAF in IO::Buffer#~ when self is an invalidated slice

`io_buffer_not` accessed `buffer->base` directly without validating that the buffer was still live. A slice whose parent had been freed retained its stale base pointer, so calling `~` on it caused a UAF.
Use `io_buffer_get_bytes_for_rea... himura467 (Akito Shitara)