[MEDIUM] Fix cross-buffer buffer-pool use-after-free

[OskarEichler]

Summary

The buffer pool can release a memory page while a live CBOR::Buffer still reads from it. A second buffer that reuses the page can overwrite the first buffer's unread bytes, producing deterministic cross-buffer data disclosure and corruption. This fixes the use-after-free by transferring read-memory ownership when the inline tail becomes a heap chunk and clearing stale ownership pointers before destruction.

This addresses #35 and ports the corresponding ownership repair from msgpack 1.8.4.

Reproduction and mechanism

The complete deterministic reproducer is in #35. On cbor 0.5.10.3 with Ruby 3.4.7/aarch64 Linux it returned bytes written by a different buffer in 50/50 runs. Removing the second buffer or using only copied writes produced 0/50 corruptions.

_msgpack_buffer_add_new_chunk copies b->tail into a new chunk without moving b->rmem_owner. When the old head is shifted, the page is returned to the process-global pool even though the new tail still references it. Another buffer can then reuse and overwrite the page.

Verification

• Focused cross-buffer ownership model: 50/50 corruptions on 0.5.10.3; 0/50 on this branch.
• Both control cases remain 0/50.
• Existing suite: 170 examples, 0 failures.
• Native extension compiles on Ruby 4.0.6.

No tests were changed because this repository asks contributors not to add or modify tests.

Scope and limitations

The demonstrated path uses the low-level CBOR::Buffer API with a specific mix of copied and referenced writes across buffers. I could not reach it through CBOR.decode or a single CBOR::Unpacker; those paths use buffer thresholds that avoid the triggering ownership transition.

The reproducer was exercised on aarch64 Linux. The ownership defect is platform-independent C logic, but allocator behavior on other platforms was not measured.

Breaking changes

None. The patch only corrects internal buffer ownership and preserves the public API and encoded data.