[pull] master from ruby:master - #1416
Merged
Merged
Conversation
[Bug #22319]
Array#zip triggers an use-after-free it does not account for when the call
to rb_check_array_type modifies the source array. The following script crashes:
a = (1..100_000).to_a
evil = Object.new; $a = a
def evil.to_ary; $a.clear; [1,2,3]; end
a.zip(evil)
Warnings for chilled strings can be intercepted by `Warning` module.
It held the base pointer for `ruby_xfree(ptr)` while the loop advanced `argv`. The free became `RB_ALLOCV_END(ptr_obj)` in da4bd3b, and nothing has read it since. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Only `lib` and `test` are synced from ruby/test-unit-ruby-core, so no gemspec exists in this tree and `Gem::Specification.load(nil)` returned nil. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… and SvcParamKeys Decoding an unknown (type, class) pair or an unknown SvcParamKey registered the generated class in a constant and in ClassHash permanently, so a malicious response could exhaust memory. Dropping the registration means a fresh class per decode, which breaks the class identity that Resource#== and Message#== relied on, so both now compare through Resource::Generic.type_class_equal?. Fixes CVE-2026-80212. ruby/resolv@9e331b5960
Syncing starts by `rm_rf`-ing every destination, so the `lib` and `test` directory mappings wiped ruby/ruby own files under `tool/lib` and `tool/test`, leaving only the eight files the upstream has. They also made `Repository.find_upstream` claim both directories whole. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Upstream bumps the version right after a release, so a synced tree usually holds a version nobody can install, and `bundle install` against ruby-dev locks to it. `check_prerelease_version` already knows the latest released version, so append `.dev` there when the tree is ahead of it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Avoid gem build failures when `gperf` is installed because the gem omits `win32_vk.mk`. ruby/io-console@3813a43247
…NS types and SvcParamKeys" This reverts commit ruby/resolv@9e331b5960a8, which contains only the same test code as previous two commits; ruby/resolv@05185b43229f and ruby/resolv@fcff0a19e401 ruby/resolv@90fa897e28
Fix use-after-free of dangling pointers.
[Bug #22321]
In the following script, the klass of the Method object is an iclass, which
will raise an error "NoMethodError: undefined method 'inspect' for an instance of M":
module M
def foo = 1
end
class C
include M
end
obj = C.new
meth = obj.method(:foo).unbind.bind(obj)
puts meth.inspect
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )