Issue #22112 has been reported by nagachika (Tomoyuki Chikanaga). ---------------------------------------- Bug #22112: Backport for IO::Buffer USF issues https://bugs.ruby-lang.org/issues/22112 * Author: nagachika (Tomoyuki Chikanaga) * Status: Closed * Backport: 3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED ---------------------------------------- The following commits are a series of fixes for IO::Buffer use-after-free issues across multiple methods. Please backport them to the stable branches. - commit:2552db04ddc44349c7b0f5f93aeb0fb02eccb509 (Fix UAF in IO::Buffer#&) - commit:95626e3a9c59cd073221c08ed013ed0f2d655b6f (Fix UAF in IO::Buffer#|) - commit:90ed85f91ed8c9df26efcbdc5e6a1b428be3ef06 (Fix UAF in IO::Buffer#^) - commit:3373fcc2dee7c4560d2c3e4280c549cdb1b5de63 (Fix UAF in IO::Buffer#~) - commit:4bd3e14fc2623414680008c7b1d38f1a3df2877e (Fix UAF in IO::Buffer#and!, IO::Buffer#or!, IO::Buffer#xor!) - commit:2c8002d58302e4fff51484826e1fd706cc2bfb19 (Validate the buffer after argument conversion) - commit:773e0c3a0f2ab2bd235c8d44cad1f999bfe2514b (Validate the buffer after type argument conversion) -- https://bugs.ruby-lang.org/