curb 1.4.1 → 1.5.0

data/ext/curb_multi.c

@@ -908,20 +908,29 @@ static VALUE call_status_handler2(VALUE ary) {
   return rb_funcall(rb_ary_entry(ary, 0), idCall, 2, rb_ary_entry(ary, 1), rb_ary_entry(ary, 2));
 }
 
+/* The default body/header buffers grow geometrically, leaving up to half
+ * their capacity unused. Once the transfer is complete, give that back so a
+ * retained body_str/header_str is exact-fit. rb_str_resize only reallocates
+ * when the excess is significant. */
+static void trim_default_buffers(ruby_curl_easy *rbce) {
+  VALUE body = rb_easy_get("body_data");
+  VALUE header = rb_easy_get("header_data");
+  if (RB_TYPE_P(body, T_STRING) && !OBJ_FROZEN(body)) {
+    rb_str_resize(body, RSTRING_LEN(body));
+  }
+  if (RB_TYPE_P(header, T_STRING) && !OBJ_FROZEN(header)) {
+    rb_str_resize(header, RSTRING_LEN(header));
+  }
+}
+
 static void flush_stderr_if_any(ruby_curl_easy *rbce) {
   VALUE stderr_io = rb_easy_get("stderr_io");
-  if (stderr_io != Qnil) {
-    /* Flush via Ruby IO API */
+  /* The caller may have closed their IO; curb's own stream stays valid. */
+  if (stderr_io != Qnil && !RTEST(rb_funcall(stderr_io, rb_intern("closed?"), 0))) {
     rb_funcall(stderr_io, rb_intern("flush"), 0);
-#ifdef HAVE_RUBY_IO_H
-    /* Additionally flush underlying FILE* to be extra safe. */
-    rb_io_t *open_f_ptr;
-    if (RB_TYPE_P(stderr_io, T_FILE)) {
-      GetOpenFile(stderr_io, open_f_ptr);
-      FILE *fp = rb_io_stdio_file(open_f_ptr);
-      if (fp) fflush(fp);
-    }
-#endif
+  }
+  if (rbce->stderr_file) {
+    fflush(rbce->stderr_file);
   }
 }
 
@@ -1203,6 +1212,7 @@ static void rb_curl_mutli_handle_complete(VALUE self, CURL *easy_handle, int res
 
   /* Flush again after removal to cover any last buffered data. */
   flush_stderr_if_any(rbce);
+  trim_default_buffers(rbce);
 
   struct multi_complete_callback_args args = {
     self,
@@ -1788,6 +1798,9 @@ static int collect_io_select_ready_i(st_data_t key, st_data_t val, st_data_t arg
 
 static void rb_curl_multi_socket_drive(VALUE self, ruby_curl_multi *rbcm, multi_socket_ctx *ctx, VALUE block) {
   CURLMcode mrc;
+  /* Looking up the Ractor-local default costs two method calls; read it once
+   * per drive rather than on every wait. */
+  const long default_timeout_ms = curb_multi_default_timeout();
 
   do {
     /* Prime the state: let libcurl act on timeouts to set up sockets. */
@@ -1799,7 +1812,7 @@ static void rb_curl_multi_socket_drive(VALUE self, ruby_curl_multi *rbcm, multi_
 
     while (rbcm->running) {
     struct timeval tv = {0, 0};
-    long wait_ms = curb_multi_default_timeout();
+    long wait_ms = default_timeout_ms;
 
     if (multi_socket_timer_due(ctx)) {
       ctx->timeout_deadline_ms = -1;
@@ -2289,6 +2302,7 @@ static VALUE ruby_curl_multi_perform_impl(int argc, VALUE *argv, VALUE self) {
   CURLMcode mcode;
   ruby_curl_multi *rbcm;
   long timeout_milliseconds;
+  long default_timeout_ms;
   VALUE block = Qnil;
 #ifndef CURB_USE_MULTI_POLL
   int maxfd, rc = -1;
@@ -2311,7 +2325,10 @@ static VALUE ruby_curl_multi_perform_impl(int argc, VALUE *argv, VALUE self) {
     clear_multi_deferred_exception_source_id_if_any(self);
   }
 
-  timeout_milliseconds = curb_multi_default_timeout();
+  /* Looking up the Ractor-local default costs two method calls; read it once
+   * per perform rather than up to twice per wait-loop iteration. */
+  default_timeout_ms = curb_multi_default_timeout();
+  timeout_milliseconds = default_timeout_ms;
 
   // Run curl_multi_perform for the first time to get the ball rolling
   rb_curl_multi_run( self, rbcm->handle, &(rbcm->running) );
@@ -2351,8 +2368,8 @@ static VALUE ruby_curl_multi_perform_impl(int argc, VALUE *argv, VALUE self) {
         continue;
       }
 
-      if (timeout_milliseconds < 0 || timeout_milliseconds > curb_multi_default_timeout()) {
-        timeout_milliseconds = curb_multi_default_timeout(); /* libcurl doesn't know how long to wait, use a default timeout */
+      if (timeout_milliseconds < 0 || timeout_milliseconds > default_timeout_ms) {
+        timeout_milliseconds = default_timeout_ms; /* libcurl doesn't know how long to wait, use a default timeout */
                                                         /* or buggy versions libcurl sometimes reports huge timeouts... let's cap it */
       }
 

data/ext/extconf.rb

@@ -699,6 +699,7 @@ have_header('ruby/thread.h') && have_func('rb_thread_call_without_gvl', 'ruby/th
 have_header('ruby/io.h')
 # Ruby 4.x exports rb_thread_fd_select without declaring it in ruby/io.h.
 have_func('rb_thread_fd_select')
+have_func('rb_io_descriptor', 'ruby/io.h')
 have_func('rb_wait_for_single_fd', 'ruby/io.h')
 have_header('ruby/fiber/scheduler.h')
 have_func('rb_fiber_scheduler_current', 'ruby/fiber/scheduler.h')

data/lib/curl/easy.rb

@@ -53,6 +53,11 @@ module Curl
 
       def flush_deferred_multi_closes(all_threads: false)
         state = deferred_multi_close_state
+        # Fast path: nothing queued, so skip the mutex and list partitioning.
+        # A close queued concurrently by another thread is picked up next time.
+        queued = state[:deferred_multi_closes]
+        return if queued.nil? || queued.empty?
+
         pending = deferred_multi_close_mutex.synchronize do
           deferred_closes = (state[:deferred_multi_closes] ||= [])
 
@@ -189,11 +194,15 @@ module Curl
       config = Curl.__send__(:ractor_local_state)[:safety_config] || Curl::SafetyConfig.new
       limit = Curl::SafetyConfig.new
       limit.max_body_bytes = options.fetch(:max_body_bytes, config.max_body_bytes)
+      limit.timeout = options.fetch(:timeout, config.timeout)
+      limit.max_redirects = options.fetch(:max_redirects, config.max_redirects)
       __curb_set_safety_override!(
         :protocols => [:http, :https],
         :redirect_protocols => [:http, :https],
         :network_policy => :public,
-        :max_body_bytes => limit.max_body_bytes
+        :max_body_bytes => limit.max_body_bytes,
+        :timeout => limit.timeout,
+        :max_redirects => limit.max_redirects
       )
     end
 
@@ -205,6 +214,8 @@ module Curl
       @__curb_safety_override[:redirect_protocols] = Array(options[:redirect_protocols]).map { |protocol| protocol.to_s.downcase.to_sym } if options.key?(:redirect_protocols)
       @__curb_safety_override[:max_body_bytes] = options[:max_body_bytes] if options.key?(:max_body_bytes)
       @__curb_safety_override[:network_policy] = options[:network_policy] if options.key?(:network_policy)
+      @__curb_safety_override[:timeout] = options[:timeout] if options.key?(:timeout)
+      @__curb_safety_override[:max_redirects] = options[:max_redirects] if options.key?(:max_redirects)
       @__curb_safety_override_generation = __curb_safety_override_generation + 1
       Curl.__send__(:apply_safety!, self) if Curl.respond_to?(:apply_safety!, true)
       self
@@ -270,7 +281,9 @@ module Curl
     # the configured HTTP Verb.
     #
     def perform
-      Curl.__send__(:apply_safety!, self) if Curl.respond_to?(:apply_safety!, true)
+      # Validate eagerly so an unsafe request raises in the caller (and not in
+      # a shared scheduler driver fiber). Multi#add re-applies it as well.
+      Curl.__send__(:apply_safety!, self) if Curl.__send__(:safety_active_for?, self)
       self.class.flush_deferred_multi_closes
 
       if Curl.scheduler_active? && self.multi.nil?

data/lib/curl/multi.rb

@@ -353,6 +353,15 @@ module Curl
       ]
     end
 
+    # True when no per-easy safety state (override or native policy) is set.
+    # Callers must separately check that no global Curl.safe! config exists.
+    def __curb_safety_unconstrained?(easy)
+      easy.instance_variable_get(:@__curb_safety_override).nil? &&
+        easy.network_policy == :none &&
+        easy.allowed_hosts.nil? &&
+        easy.allowed_cidrs.nil?
+    end
+
     def __record_native_safety_signature(easy)
       __curb_native_safety_signatures[easy.object_id] = __curb_safety_signature_for(easy)
     end
@@ -419,24 +428,33 @@ module Curl
 
     private :__idle_easy_references, :__curb_native_safety_signatures,
             :__curb_safety_signature_for, :__record_native_safety_signature,
+            :__curb_safety_unconstrained?,
             :__register_idle_easy_reference,
             :__unregister_idle_easy_reference, :__clear_idle_easy_references,
             :__new_idle_easy_references
 
     alias_method :_curb_native_perform, :perform
 
-    def perform(*args, &block)
+    def perform(&block)
+      safety_config_active = !Curl.__send__(:ractor_local_state)[:safety_config].nil?
+      signatures = __curb_native_safety_signatures
+
       requests.each_value do |easy|
-        Curl.__send__(:apply_safety!, easy) if Curl.respond_to?(:apply_safety!, true)
+        # An easy added with no safety state recorded no signature. If it is
+        # still unconstrained its signature would be unchanged, so there is
+        # nothing to apply and no need to re-run native setup.
+        next if !safety_config_active && !signatures.key?(easy.object_id) &&
+                __curb_safety_unconstrained?(easy)
+
+        Curl.__send__(:apply_safety!, easy)
         signature = __curb_safety_signature_for(easy)
-        if __curb_native_safety_signatures[easy.object_id] != signature &&
-           easy.respond_to?(:__curb_native_setup!, true)
+        if signatures[easy.object_id] != signature
           easy.__send__(:__curb_native_setup!)
-          __curb_native_safety_signatures[easy.object_id] = signature
+          signatures[easy.object_id] = signature
         end
       end
 
-      _curb_native_perform(*args, &block)
+      _curb_native_perform(&block)
     end
 
     def add(easy)
@@ -444,11 +462,15 @@ module Curl
       # Once a deferred callback exception is pending, Multi#perform is
       # draining existing transfers only and must not start replacement work.
       return self if instance_variable_defined?(:@__curb_deferred_exception)
-      Curl.__send__(:apply_safety!, easy) if Curl.respond_to?(:apply_safety!, true)
+      unconstrained = Curl.__send__(:ractor_local_state)[:safety_config].nil? &&
+                      __curb_safety_unconstrained?(easy)
+      Curl.__send__(:apply_safety!, easy) unless unconstrained
       _add(easy)
       __unregister_idle_easy_reference(easy)
       requests[easy.object_id] = easy
-      __record_native_safety_signature(easy)
+      # Unconstrained easies record no signature; #perform treats a missing
+      # signature as "added with no safety state" (see #perform).
+      __record_native_safety_signature(easy) unless unconstrained
       self
     end
 

data/lib/curl.rb

@@ -12,9 +12,14 @@ module Curl
   # Ractors, even when the value itself would otherwise be safe. Keep curb's
   # mutable Ruby-side configuration in storage owned by the current Ractor.
   # Older Rubies retain the historical process-wide state.
+  # Ractor capabilities can't change at runtime, so probe them once instead of
+  # on every call: this lookup sits on the per-request path.
+  RACTOR_LOCAL_STORAGE = !!(defined?(Ractor) && Ractor.respond_to?(:current) &&
+                            Ractor.current.respond_to?(:[]) && Ractor.current.respond_to?(:[]=))
+  private_constant :RACTOR_LOCAL_STORAGE
+
   def self.ractor_local_state
-    if defined?(Ractor) && Ractor.respond_to?(:current) &&
-       Ractor.current.respond_to?(:[]) && Ractor.current.respond_to?(:[]=)
+    if RACTOR_LOCAL_STORAGE
       Ractor.current[:__curb_ractor_local_state] ||= {}
     else
       @legacy_local_state ||= {}
@@ -24,14 +29,18 @@ module Curl
   class SafetyConfig
     DEFAULT_PROTOCOLS = [:http, :https].freeze
     DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024
+    DEFAULT_TIMEOUT = 60
+    DEFAULT_MAX_REDIRECTS = 20
 
-    attr_reader :max_body_bytes, :network_policy
+    attr_reader :max_body_bytes, :network_policy, :timeout, :max_redirects
     attr_accessor :allow_proxies, :allow_resolve, :allow_connect_to, :allow_doh, :allow_unix_socket
 
     def initialize
       @protocols = DEFAULT_PROTOCOLS
       @redirect_protocols = nil
       @max_body_bytes = DEFAULT_MAX_BODY_BYTES
+      @timeout = DEFAULT_TIMEOUT
+      @max_redirects = DEFAULT_MAX_REDIRECTS
       @network_policy = :public
       @allowed_hosts = nil
       @allowed_proxy_hosts = nil
@@ -83,6 +92,32 @@ module Curl
       @max_body_bytes = bytes.zero? ? nil : bytes
     end
 
+    # Seconds; applied to handles with no timeout of their own. nil disables.
+    def timeout=(seconds)
+      if seconds.nil?
+        @timeout = nil
+        return
+      end
+
+      seconds = Float(seconds)
+      raise ArgumentError, "timeout must be greater than zero" unless seconds > 0
+
+      @timeout = seconds
+    end
+
+    # Applied to handles whose max_redirects is unset or unlimited. nil disables.
+    def max_redirects=(count)
+      if count.nil?
+        @max_redirects = nil
+        return
+      end
+
+      count = Integer(count)
+      raise ArgumentError, "max_redirects must be greater than or equal to zero" if count < 0
+
+      @max_redirects = count
+    end
+
     def network_policy=(policy)
       @network_policy = normalize_network_policy(policy)
     end
@@ -227,9 +262,26 @@ module Curl
 
     apply_max_body_bytes!(easy, config.max_body_bytes) if config&.max_body_bytes
     apply_max_body_bytes!(easy, override[:max_body_bytes]) if override && override.key?(:max_body_bytes)
+    apply_default_timeout!(easy, override && override.key?(:timeout) ? override[:timeout] : config&.timeout)
+    apply_default_max_redirects!(easy, override && override.key?(:max_redirects) ? override[:max_redirects] : config&.max_redirects)
     easy
   end
 
+  # Only fills in a limit the handle has not chosen itself.
+  def self.apply_default_timeout!(easy, seconds)
+    return unless seconds
+    return unless easy.timeout_ms.to_i.zero?
+
+    easy.timeout = seconds
+  end
+
+  def self.apply_default_max_redirects!(easy, count)
+    return unless count
+
+    current = easy.max_redirects
+    easy.max_redirects = count if current.nil? || current < 0
+  end
+
   def self.clear_safe!
     ractor_local_state[:safety_config] = nil
     bump_safety_generation!
@@ -250,9 +302,7 @@ module Curl
   end
 
   def self.safety_override_for(easy)
-    if easy.respond_to?(:__curb_safety_override, true)
-      easy.__send__(:__curb_safety_override)
-    end
+    easy.instance_variable_get(:@__curb_safety_override)
   end
 
   def self.safety_generation
@@ -417,6 +467,7 @@ module Curl
                        :safety_generation, :bump_safety_generation!,
                        :safety_protocol_intersection,
                        :apply_max_body_bytes!, :apply_public_network_policy_controls!,
+                       :apply_default_timeout!, :apply_default_max_redirects!,
                        :apply_allowed_hosts!, :apply_allowed_cidrs!,
                        :apply_allowed_proxy!, :normalize_proxy_host,
                        :reject_resolve_override!, :reject_connect_to_override!,
@@ -424,6 +475,12 @@ module Curl
                        :reject_unix_socket_override!,
                        :disable_proxy!
 
+  # Multi#perform under a fiber scheduler uses the socket-action loop, which
+  # waits through the scheduler, exactly when this native method exists
+  # (same build condition). Otherwise it falls back to a thread-blocking wait.
+  SCHEDULER_COOPERATIVE_PERFORM = Curl::Multi.private_method_defined?(:_socket_perform)
+  private_constant :SCHEDULER_COOPERATIVE_PERFORM
+
   def self.scheduler_active?
     Fiber.respond_to?(:scheduler) && !Fiber.scheduler.nil?
   end
@@ -603,7 +660,11 @@ module Curl
             state[:multi].perform do
               drain_scheduler_pending(state)
               release_scheduler_waiters(state)
-              scheduler_yield
+              # The socket-action loop already waits through the scheduler on
+              # every pass, so sibling fibers run without an extra yield (which
+              # cost ~4 yields per request). The fallback loop blocks the thread
+              # while waiting, so it still needs one.
+              scheduler_yield unless SCHEDULER_COOPERATIVE_PERFORM
             end
           ensure
             # Release any siblings that completed just before a deferred
@@ -757,7 +818,7 @@ module Curl
   end
 
   def self.safe_http_option_keys
-    [:max_body_bytes]
+    [:max_body_bytes, :timeout, :max_redirects]
   end
 
   def self.reset

data/tests/bug_curb_easy_blocks_ruby_threads.rb

@@ -4,7 +4,7 @@ class BugTestInstancePostDiffersFromClassPost < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     @response_proc = lambda do|res|
       sleep 0.5
       res.body = "hi"

data/tests/bug_follow_redirect_288.rb

@@ -4,7 +4,7 @@ class BugFollowRedirect288 < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     super
     @server.mount_proc("/redirect_to_test") do|req,res|
       res.set_redirect(WEBrick::HTTPStatus::TemporaryRedirect, "/test")

data/tests/bug_poison.rb

@@ -5,7 +5,7 @@ class BugTestPoisonResponse < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     @response_proc = lambda do|res|
       sleep 0.5
       res.body = "hi"

data/tests/bug_raise_on_callback.rb

@@ -4,7 +4,7 @@ class BugRaiseOnCallback < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     super
   end
 

data/tests/helper.rb

@@ -206,16 +206,17 @@ class TestServlet < WEBrick::HTTPServlet::AbstractServlet
 end
 
 module BugTestServerSetupTeardown
-  def unused_local_port
-    socket = TCPServer.new('127.0.0.1', 0)
-    socket.addr[1]
-  ensure
-    socket.close if socket
-  end
-
   def setup
     @port ||= 9992
-    @server = WEBrick::HTTPServer.new(:Port => @port, :Logger => WEBRICK_TEST_LOG, :AccessLog => [])
+    # Bind 127.0.0.1 explicitly: with no bind address, WEBrick silently keeps
+    # just the IPv6 listener if the IPv4 bind fails, leaving 127.0.0.1:@port
+    # refusing connections. :auto lets the kernel pick a free port at bind
+    # time instead of reserving one and re-binding it later, which could race
+    # with client connections reusing that ephemeral port (seen on macOS).
+    @server = WEBrick::HTTPServer.new(:Port => (@port == :auto ? 0 : @port),
+                                      :BindAddress => '127.0.0.1',
+                                      :Logger => WEBRICK_TEST_LOG, :AccessLog => [])
+    @port = @server.config[:Port]
     @server.mount_proc("/test") do|req,res|
       if @response_proc
         @response_proc.call(res)

data/tests/tc_curl_easy.rb

@@ -179,6 +179,32 @@ class TestCurbCurlEasy < Test::Unit::TestCase
     assert_match(/GET/, http.body)
   end
 
+  # The default body/header buffers used to reserve 32 KB/16 KB up front, and
+  # that capacity stayed attached to every returned string.
+  def test_small_response_strings_do_not_retain_large_buffers
+    require 'objspace'
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.perform
+
+    body = easy.body_str
+    header = easy.header_str
+    assert_operator body.bytesize, :>, 0
+    assert_operator ObjectSpace.memsize_of(body), :<, 4096, 'body_str keeps excess capacity'
+    assert_operator ObjectSpace.memsize_of(header), :<, 4096, 'header_str keeps excess capacity'
+  end
+
+  def test_large_response_body_is_complete
+    require 'objspace'
+    server = CurbTinyHTTPServer.new
+    expected = CurbTinyHTTPServer.stream_body(64, 4096)
+    easy = Curl::Easy.new(server.url('/stream/64/4096'))
+    easy.perform
+    assert_equal expected, easy.body_str
+    assert_operator ObjectSpace.memsize_of(easy.body_str), :<, expected.bytesize + 4096
+  ensure
+    server.close if server
+  end
+
   def test_curlopt_stderr_with_file
     # does not work with Tempfile directly
     path = Tempfile.new('curb_test_curlopt_stderr').path
@@ -239,6 +265,92 @@ class TestCurbCurlEasy < Test::Unit::TestCase
     tmp.close! if defined?(tmp) && tmp
   end
 
+  # libcurl used to write through the IO's own FILE*, which Ruby frees on
+  # close. curb now owns a stream on a duplicate descriptor instead.
+  def test_curlopt_stderr_survives_block_form_file_close
+    tmp = Tempfile.new('curb_test_curlopt_stderr_closed')
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.verbose = true
+    File.open(tmp.path, 'w') { |file| easy.setopt(Curl::CURLOPT_STDERR, file) }
+
+    2.times { easy.perform }
+
+    output = File.read(tmp.path)
+    assert_equal 2, output.scan(/HTTP\/1\.1 200 OK/).length
+  ensure
+    tmp.close! if tmp
+  end
+
+  def test_curlopt_stderr_survives_close_after_multi_add
+    tmp = Tempfile.new('curb_test_curlopt_stderr_multi')
+    file = File.open(tmp.path, 'w')
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.verbose = true
+    easy.setopt(Curl::CURLOPT_STDERR, file)
+    multi = Curl::Multi.new
+    multi.add(easy)
+    file.close
+    GC.start
+
+    multi.perform
+
+    assert_equal 200, easy.response_code
+    assert_match(/HTTP\/1\.1 200 OK/, File.read(tmp.path))
+  ensure
+    multi.close if multi
+    tmp.close! if tmp
+  end
+
+  def test_curlopt_stderr_clone_owns_its_stream
+    tmp = Tempfile.new('curb_test_curlopt_stderr_clone')
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.verbose = true
+    File.open(tmp.path, 'w') { |file| easy.setopt(Curl::CURLOPT_STDERR, file) }
+    copy = easy.clone
+
+    # Releasing the original's stream must not affect the clone's.
+    easy.close
+    GC.start
+    copy.perform
+
+    assert_equal 200, copy.response_code
+    assert_match(/HTTP\/1\.1 200 OK/, File.read(tmp.path))
+  ensure
+    tmp.close! if tmp
+  end
+
+  def test_curlopt_stderr_streams_are_released
+    fd_dir = '/proc/self/fd'
+    omit('needs /proc/self/fd to count open descriptors') unless File.directory?(fd_dir)
+    tmp = Tempfile.new('curb_test_curlopt_stderr_release')
+    file = File.open(tmp.path, 'w')
+    easy = Curl::Easy.new(TestServlet.url)
+    before = Dir.children(fd_dir).length
+
+    # Replacement, reset, and close each release curb's descriptor.
+    20.times { easy.setopt(Curl::CURLOPT_STDERR, file) }
+    easy.reset
+    easy.setopt(Curl::CURLOPT_STDERR, file)
+    easy.close
+    easy.setopt(Curl::CURLOPT_STDERR, file)
+    easy.clone.close
+    easy.close
+
+    assert_equal before, Dir.children(fd_dir).length
+  ensure
+    file.close if file && !file.closed?
+    tmp.close! if tmp
+  end
+
+  def test_curlopt_stderr_rejects_unwritable_io
+    tmp = Tempfile.new('curb_test_curlopt_stderr_readonly')
+    File.open(tmp.path, 'r') do |file|
+      assert_raise(IOError) { Curl::Easy.new.setopt(Curl::CURLOPT_STDERR, file) }
+    end
+  ensure
+    tmp.close! if tmp
+  end
+
   def test_head_request_no_body_and_no_timeout
     # Ensure a HEAD request completes and does not attempt to read a body
     # even when the server advertises a Content-Length.
@@ -2119,4 +2231,80 @@ class TestCurbCurlEasy < Test::Unit::TestCase
     server_setup
   end
 
+  # Replacing request state while libcurl is still sending the old state
+  # freed buffers libcurl was reading (use-after-free). Every entry point that
+  # hands libcurl new request state must refuse while the handle is active.
+  ACTIVE_HANDLE_MUTATORS = {
+    'post_body=' => ->(easy) { easy.post_body = 'replacement' },
+    'put_data=' => ->(easy) { easy.put_data = 'replacement' },
+    'autoreferer=' => ->(easy) { easy.autoreferer = true },
+    'http_post' => ->(easy) { easy.http_post('replacement') },
+    'http_put' => ->(easy) { easy.http_put('replacement') },
+    'http_patch' => ->(easy) { easy.http_patch('replacement') },
+    'http_delete' => ->(easy) { easy.http_delete },
+    'http(:OPTIONS)' => ->(easy) { easy.http(:OPTIONS) },
+    '__curb_native_setup!' => ->(easy) { easy.__send__(:__curb_native_setup!) },
+  }.freeze
+
+  def test_request_state_cannot_be_replaced_during_own_transfer
+    ACTIVE_HANDLE_MUTATORS.each do |name, mutate|
+      easy = Curl::Easy.new(TestServlet.url)
+      easy.post_body = 'original'
+      errors = []
+      easy.on_body do |data|
+        begin
+          mutate.call(easy)
+        rescue RuntimeError => e
+          errors << e
+        end
+        data.bytesize
+      end
+
+      easy.perform
+
+      assert_equal 1, errors.length, name
+      assert_match(/Cannot modify an active curl handle/, errors.first.message, name)
+      assert_equal 200, easy.response_code, name
+      assert_equal 'original', easy.post_body, name
+
+      # Once idle, the same mutation is allowed again.
+      easy.on_body
+      assert_nothing_raised(name) { mutate.call(easy) }
+    end
+  end
+
+  def test_request_state_cannot_be_replaced_on_active_sibling_transfer
+    ACTIVE_HANDLE_MUTATORS.each do |name, mutate|
+      # The sibling's response is delayed so it is still in flight when the
+      # first transfer's body callback runs.
+      server = CurbTinyHTTPServer.new
+      multi = Curl::Multi.new
+      first = Curl::Easy.new(TestServlet.url)
+      sibling = Curl::Easy.new(server.url('/delay/0.3'))
+      sibling.post_body = 'original'
+      errors = []
+      first.on_body do |data|
+        begin
+          mutate.call(sibling)
+        rescue RuntimeError => e
+          errors << e
+        end
+        data.bytesize
+      end
+
+      multi.add(first)
+      multi.add(sibling)
+      multi.perform
+
+      assert_operator errors.length, :>=, 1, name
+      errors.each { |e| assert_match(/Cannot modify an active curl handle/, e.message, name) }
+      assert_equal 200, sibling.response_code, name
+      assert_equal 'delayed', sibling.body_str, name
+      assert_equal 'original', sibling.post_body, name
+    ensure
+      multi.close if multi
+      server.close if server
+    end
+  end
+
 end