Issue #22315 has been updated by k0kubun (Takashi Kokubun). Backport changed from 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ruby_4_0 commit:b58cb49058b9b7c4f8e5dde66e5824ad54f25037. ---------------------------------------- Bug #22315: heap-use-after-free in String unpack with a block that mutates the receiver https://bugs.ruby-lang.org/issues/22315#change-119435 * Author: danielchong (Daniel Chong) * Status: Closed * ruby -v: 4.1.0-dev * Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: DONE ---------------------------------------- PoC: ``` s = "C" * 4000 s.unpack("L*") { s.clear } ``` Asan (truncated): ``` ERROR: AddressSanitizer: heap-use-after-free on address 0x... READ of size 4 ... thread T0 #3 bary_unpack_internal bignum.c:1179 #4 rb_integer_unpack bignum.c:3753 #5 pack_unpack_internal pack.c:1415 <-- USE 0x... is located 4 bytes inside of 4001-byte region [...] freed by thread T0 here: #2 ruby_xfree_sized gc.c:6295 #3 str_discard string.c:2840 #4 rb_str_clear string.c:6678 ... #16 rb_yield vm_eval.c #17 pack_unpack_internal pack.c:1416 <-- FREE (user block via rb_yield) ``` -- https://bugs.ruby-lang.org/