From fe874f9ecdbc0f7799cb92f4972bda74acbc06c2 Mon Sep 17 00:00:00 2001 From: Songstats Dependency Audit Date: Sat, 29 Aug 2026 22:49:29 +0200 Subject: [PATCH 1/2] Validate AtomicFixnum update results --- ext/concurrent-ruby-ext/atomic_fixnum.c | 1 + lib/concurrent-ruby/concurrent/atomic/mutex_atomic_fixnum.rb | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ext/concurrent-ruby-ext/atomic_fixnum.c b/ext/concurrent-ruby-ext/atomic_fixnum.c index 088874006..2abe9c5f7 100644 --- a/ext/concurrent-ruby-ext/atomic_fixnum.c +++ b/ext/concurrent-ruby-ext/atomic_fixnum.c @@ -73,6 +73,7 @@ VALUE method_atomic_fixnum_update(VALUE self) { for (;;) { old_value = method_atomic_fixnum_value(self); new_value = rb_yield(old_value); + Check_Type(new_value, T_FIXNUM); if (ir_compare_and_set(self, old_value, new_value) == Qtrue) { return new_value; } diff --git a/lib/concurrent-ruby/concurrent/atomic/mutex_atomic_fixnum.rb b/lib/concurrent-ruby/concurrent/atomic/mutex_atomic_fixnum.rb index 0ca395579..132616b77 100644 --- a/lib/concurrent-ruby/concurrent/atomic/mutex_atomic_fixnum.rb +++ b/lib/concurrent-ruby/concurrent/atomic/mutex_atomic_fixnum.rb @@ -55,7 +55,7 @@ def compare_and_set(expect, update) # @!macro atomic_fixnum_method_update def update synchronize do - @value = yield @value + ns_set(yield @value) end end From a9eaa98212afe76ae0af4fdd11d931ef2a3c7e66 Mon Sep 17 00:00:00 2001 From: Oskar Eichler Date: Sun, 30 Aug 2026 15:06:45 +0700 Subject: [PATCH 2/2] Test invalid AtomicFixnum update results --- spec/concurrent/atomic/atomic_fixnum_spec.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/spec/concurrent/atomic/atomic_fixnum_spec.rb b/spec/concurrent/atomic/atomic_fixnum_spec.rb index 8222bf523..81b8e8bf4 100644 --- a/spec/concurrent/atomic/atomic_fixnum_spec.rb +++ b/spec/concurrent/atomic/atomic_fixnum_spec.rb @@ -152,6 +152,17 @@ atomic = described_class.new(1000) expect(atomic.update { |v| v + 1 }).to eq 1001 end + + it 'rejects a non-integer result without changing the value' do + atomic = described_class.new(1000) + + expect { + atomic.update { 'not an integer' } + }.to(raise_error { |error| + expect(error.class).to be(ArgumentError).or(be(TypeError)) + }) + expect(atomic.value).to eq 1000 + end end end