From: "nobu (Nobuyoshi Nakada) via ruby-core" <ruby-core@...>
Date: 2024-09-18T10:00:47+00:00
Subject: [ruby-core:119249] [Ruby master Bug#20752] IO::Buffer#slice fails to copy readonly flag, allowing writes into frozen String

Issue #20752 has been updated by nobu (Nobuyoshi Nakada).

Backport changed from 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN to 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED

It results in bus errors with 3.1 and 3.2.

```
$ ruby3.2 -e 'IO::Buffer.for(RUBY_DESCRIPTION).slice.set_string("perl", 0, 4)'
-e:1: [BUG] Bus Error at 0x0000000100f08b18
ruby 3.2.5 (2024-07-26 revision 31d0f1a2e7) [arm64-darwin23]
```
```
$ ruby3.1 -e 'IO::Buffer.for(RUBY_DESCRIPTION).slice(0, 8).set_string("perl", 0, 4)'
-e:1: [BUG] Bus Error at 0x00000001039c7e38
ruby 3.1.4p223 (2023-03-30 revision 957bb7cb81) [arm64-darwin23]
```

----------------------------------------
Bug #20752: IO::Buffer#slice fails to copy readonly flag, allowing writes into frozen String
https://bugs.ruby-lang.org/issues/20752#change-109830

* Author: hanazuki (Kasumi Hanazuki)
* Status: Open
* ruby -v: ruby 3.4.0dev (2024-09-18T02:16:22Z master 4797b0704a) +PRISM [x86_64-linux]
* Backport: 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED
----------------------------------------
```irb
irb(main):001> RUBY_DESCRIPTION.frozen?
=> true
irb(main):002> IO::Buffer.for(RUBY_DESCRIPTION).set_string('perl', 0, 4)
(irb):2:in 'IO::Buffer#set_string': Buffer is not writable! (IO::Buffer::AccessError)
        from (irb):2:in '<main>'
        from <internal:kernel>:191:in 'Kernel#loop'
        from -e:1:in '<main>'
irb(main):003> IO::Buffer.for(RUBY_DESCRIPTION).slice.set_string('perl', 0, 4)
=> 4
irb(main):004> RUBY_DESCRIPTION
=> "perl 3.4.0dev (2024-09-18T02:16:22Z master 4797b0704a) +PRISM [x86_64-linux]"
```

```irb
irb(main):001> IO::Buffer.for(NameError.name).slice.set_string('X', 0, 1)
=> 1
irb(main):002> NameError
(irb):2:in '<main>': uninitialized constant NameError (XameError)
        from <internal:kernel>:191:in 'Kernel#loop'
        from -e:1:in '<main>'
```



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/