The fix in commit 11f57c6 contained a bug where the calculated index should be `len - i` and not `len - 1`. This script reproduces the crash: ary = (1..100).to_a gen = Object.new gen.define_singleton_method(:rand) { |lim| 8 ...peterzhu2118 (Peter Zhu)
Currently, if GC is disabled, postmortem GC is not ran when a Ractor dies. This can cause the object space to have issues because we need to run the postmortem GC. This commit will guarantee that it runs.peterzhu2118 (Peter Zhu)
If the format string is modified during Array#pack (by conversion such as to_str, to_int, etc.), it can cause an use-after-free since reading p[-1] may be an use-after-free. We should read that byte before performing the conversion. The...peterzhu2118 (Peter Zhu)
For strings larger than or equal to IO_BUFFER_BLOCKING_SIZE (which is 1KB), IO::Buffer#set_string will perform the memmove without GVL. In this time, another thread can resize the IO::Buffer object. In that case, the buffer may be freed ...peterzhu2118 (Peter Zhu)
When the string buffer reaches BUFSIZ (8192 bytes), Marshal.dump will call the write method on the IO object. This IO object can run arbitrary Ruby code. If the object is a string, it writes the length of the string followed by the bytes...peterzhu2118 (Peter Zhu)
If the source string is modified in the block of String#unpack, it can cause an use-after-free. For example, the following script crashes: fmt = "A" * 1_000_000 str = "C" * 1_000_000 str.unpack(fmt) { fmt.clear }peterzhu2118 (Peter Zhu)
peterzhu2118 (Peter Zhu)09:36 AM Ruby Revision d939272e (git): Fix out-of-bounds in Array#sample when array modified