[pull] master from ruby:master - #1362
Merged
Merged
Conversation
transcode_loop() passed the fallback result to rb_econv_insert_output() as a bare pointer and length. Nothing roots the string during that call: args.rep still holds the pre-fallback error-bytes string, and with clang -O3 the VALUE itself lives in no stack slot the conservative scan can see -- only the raw data pointer survives in a register, and for an embedded string that is an interior pointer the scanner rejects. rb_econv_insert_output() can run a GC: when the fallback string's encoding differs from the converter's insert encoding it calls allocate_converted_string(), which opens a fresh econv and allocates the destination buffer. The fallback string is then swept mid-call and the sub-conversion reads its freed bytes. On an ASAN build this reports use-after-poison at the 1-byte input read in transcode_restartable0(); CI hit it about once in two hundred runs of test_fallback_proc, and GC.stress reproduces it in a few hundred iterations on a clang -O3 ASAN build. With RB_GC_GUARD the same loop is clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
rb_econv_insert_output() grew the insertion buffer with
ruby_xrealloc_sized(*buf_start_p, s, buf_end_p - buf_start_p);
The old-size argument subtracts the two local pointer variables instead
of the pointers they point at, so the allocator's size accounting gets a
small constant rather than the buffer's size. Present since the sized
variant was introduced; the memory itself was never corrupted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )