From 6261d4b4d8112a461ac5a383032490007f47029c Mon Sep 17 00:00:00 2001 From: Alan Wu Date: Tue, 13 Feb 2024 12:51:36 -0500 Subject: [PATCH] Fix use-after-move in Symbol#inspect The allocation could re-embed `orig_str` and invalidate the data pointer from RSTRING_GETMEM() if the string is embedded. Found on CI, where the test introduced in 7002e776944 ("Fix Symbol#inspect for GC compaction") recently failed. See: --- string.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/string.c b/string.c index 83be7d166b..4fc6ad8e31 100644 --- a/string.c +++ b/string.c @@ -11740,11 +11740,13 @@ sym_inspect(VALUE sym) } else { rb_encoding *enc = STR_ENC_GET(str); - VALUE orig_str = str; - RSTRING_GETMEM(orig_str, ptr, len); + len = RSTRING_LEN(orig_str); str = rb_enc_str_new(0, len + 1, enc); + + // Get data pointer after allocation + ptr = RSTRING_PTR(orig_str); dest = RSTRING_PTR(str); memcpy(dest + 1, ptr, len);