Use after free in str_replace

[clayton-shopify]

The following input demonstrates a use after free bug in str_replace which occurs if the string is replaced with itself:

a = "A"*50
a.replace(a)
b = "B"*50
puts a

This code prints BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB when it should print AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.

This happens because the string buffer is freed here:

mruby/src/string.c

Line 523 in 5e3077c

mrb_free(mrb, s1->as.heap.ptr);

It is then copied here, after which it can continue to be used:

mruby/src/string.c

Line 531 in 5e3077c

s1->as.heap.ptr = s2->as.heap.ptr;

This issue was reported by https://hackerone.com/tunz