Issue #22112 has been updated by k0kubun (Takashi Kokubun). Backport changed from 3.3: REQUIRED, 3.4: DONE, 4.0: REQUIRED to 3.3: REQUIRED, 3.4: DONE, 4.0: DONE ruby_4_0 commit:30b7e9d82473006f367f4fce1661b5fd6fff6c40 merged revision(s) commit:2552db04ddc44349c7b0f5f93aeb0fb02eccb509, commit:95626e3a9c59cd073221c08ed013ed0f2d655b6f, commit:b38f133c70c44bac724c7085d59b4fca510855fb, commit:90ed85f91ed8c9df26efcbdc5e6a1b428be3ef06, commit:3373fcc2dee7c4560d2c3e4280c549cdb1b5de63, commit:4bd3e14fc2623414680008c7b1d38f1a3df2877e, commit:2c8002d58302e4fff51484826e1fd706cc2bfb19, commit:773e0c3a0f2ab2bd235c8d44cad1f999bfe2514b via https://github.com/ruby/ruby/pull/17772. ---------------------------------------- Bug #22112: Backport for IO::Buffer USF issues https://bugs.ruby-lang.org/issues/22112#change-117993 * Author: nagachika (Tomoyuki Chikanaga) * Status: Closed * Backport: 3.3: REQUIRED, 3.4: DONE, 4.0: DONE ---------------------------------------- The following commits are a series of fixes for IO::Buffer use-after-free issues across multiple methods. Please backport them to the stable branches. - commit:2552db04ddc44349c7b0f5f93aeb0fb02eccb509 (Fix UAF in IO::Buffer#&) - commit:95626e3a9c59cd073221c08ed013ed0f2d655b6f (Fix UAF in IO::Buffer#|) - commit:90ed85f91ed8c9df26efcbdc5e6a1b428be3ef06 (Fix UAF in IO::Buffer#^) - commit:3373fcc2dee7c4560d2c3e4280c549cdb1b5de63 (Fix UAF in IO::Buffer#~) - commit:4bd3e14fc2623414680008c7b1d38f1a3df2877e (Fix UAF in IO::Buffer#and!, IO::Buffer#or!, IO::Buffer#xor!) - commit:2c8002d58302e4fff51484826e1fd706cc2bfb19 (Validate the buffer after argument conversion) - commit:773e0c3a0f2ab2bd235c8d44cad1f999bfe2514b (Validate the buffer after type argument conversion) -- https://bugs.ruby-lang.org/