Bug #20755
closedIO::Buffer#transfer transfers mutable reference to String's memory but not lock ownership
Description
IO::Buffer.for
with a block yields a mutable IO::Buffer that shares underlying memory with a mutable String. While the block is executed, the String instance is temporarily locked and cannot be modified or frozen.
If you call #transfer
on the yielded IO::Buffer in the block, however, a mutable IO::Buffer can be escaped from the .for
method. Through this IO::Buffer instance, you can modify the underlying String memory even after the String instance is frozen.
irb(main):001> str = +'a'
=> "a"
irb(main):002> buf = IO::Buffer.for(str) {|b| b.transfer }
=>
#<IO::Buffer 0x00007f244d1ede98+1 EXTERNAL SLICE>
...
irb(main):003> str.freeze
=> "a"
irb(main):004> buf.set_string('b')
=> 1
irb(main):005> str
=> "b"
Updated by nobu (Nobuyoshi Nakada) about 2 months ago
- Backport changed from 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN to 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED
Updated by mame (Yusuke Endoh) about 1 month ago
- Assignee set to ioquatix (Samuel Williams)
Updated by nobu (Nobuyoshi Nakada) about 1 month ago
Updated by nobu (Nobuyoshi Nakada) about 1 month ago
- Status changed from Open to Closed
Applied in changeset git|35e124832e29b65c84d4e0e4e434616859f9bdf5.
[Bug #20755] Frozen string should not be writable via IO::Buffer
Updated by nagachika (Tomoyuki Chikanaga) 18 days ago
- Backport changed from 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED to 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED
ruby_3_2 087e4ed6cc9da9cfca1a107058905446ff474bd1 merged revision(s) 35e124832e29b65c84d4e0e4e434616859f9bdf5.
Updated by k0kubun (Takashi Kokubun) about 6 hours ago
- Backport changed from 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED to 3.1: REQUIRED, 3.2: DONE, 3.3: DONE
ruby_3_3 5ce0ba0d415deb99527c409cc5f1df16ce02ef3e merged revision(s) 35e124832e29b65c84d4e0e4e434616859f9bdf5.