Add Ruby regexp repeat-range double-free patch for 3.3 and 3.4
Backports https://github.com/ruby/ruby/pull/13332 to Ruby 3.3 and 3.4. Parsing a regexp with a too-big repetition quantifier (e.g. Regexp.new("|{2,1}")) frees the same parse node twice and aborts the process instead of raising RegexpError. Fixed upstream in Ruby 4.0, so the patch is only added to the 3.3 and 3.4 dirs.
Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/628985
Testing locally
Build the gitlab-ruby image from this branch, then run the container and
verify the patched Ruby (this image builds Ruby 3.3):
docker run -it --rm registry.gitlab.com/gitlab-org/build/cng/gitlab-rails-ee:add-ruby-regexp-double-free-patch bashRun the Ruby checks below. With the patch both commands print a rescued line and the process exits 0. Without the patch the first command aborts the process (Aborted, exit 134) instead of raising.
ruby -e 'begin; Regexp.new("|{2,1}"); puts "NOT PATCHED (no error raised)"; rescue RegexpError => e; puts "rescued RegexpError: #{e.message}"; end'
ruby -e 'begin; eval("/|{1000000}/"); rescue SyntaxError => e; puts "rescued SyntaxError: #{e.message.lines.first.strip}"; end'Expected output:
rescued RegexpError: upper is smaller than lower in repeat range: /|{2,1}/
rescued SyntaxError: (eval at -e:1):1: too big number for repeat range: /|{1000000}/Verified in the built image
Pulled the branch image on a Linux host and confirmed the patched Ruby raises rescuable errors (exit 0; an unpatched Ruby aborts with exit 134):
$ docker run --rm registry.gitlab.com/gitlab-org/build/cng/gitlab-ruby:add-ruby-regexp-double-free-patch ruby -v
ruby 3.3.12 (2026-07-16 revision 0581089df9) [x86_64-linux]
rescued RegexpError: upper is smaller than lower in repeat range: /|{2,1}/
rescued SyntaxError: (eval at -e:1):1: too big number for repeat range: /|{1000000}/