Fix use-after-free when packing a string into an IO

msgpack_buffer_append_string read the string's raw pointer up front and
then grew the buffer. Growing it runs io.write (arbitrary Ruby) and can
trigger GC, either of which may free or shrink the string's backing
memory, so the later memcpy could read freed memory and copy heap
contents into the output. Reserve the space first and read the pointer
only afterwards, clamping and zero-filling if the string shrank in the
meantime so the copy stays within the current buffer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Watson1978

ext/msgpack/buffer.h

@@ -237,14 +237,29 @@ void _msgpack_buffer_append_long_string(msgpack_buffer_t* b, VALUE string);
 
 static inline size_t msgpack_buffer_append_string(msgpack_buffer_t* b, VALUE string)
 {
-    size_t length;
-    char *ptr;
-    RSTRING_GETMEM(string, ptr, length);
+    size_t length = RSTRING_LEN(string);
 
     if(length > b->write_reference_threshold) {
         _msgpack_buffer_append_long_string(b, string);
     } else {
-        msgpack_buffer_append(b, ptr, length);
+        /* Making room can run io.write or trigger GC, either of which may free
+         * or shrink the string, so reserve the space first and only then read
+         * its pointer. */
+        if(length > msgpack_buffer_writable_size(b)) {
+            msgpack_buffer_ensure_writable(b, length);
+        }
+        char *ptr;
+        size_t current;
+        RSTRING_GETMEM(string, ptr, current);
+        if(current > length) {
+            current = length;
+        }
+        memcpy(b->tail.last, ptr, current);
+        if(current < length) {
+            memset(b->tail.last + current, 0, length - current);
+        }
+        b->tail.last += length;
+        RB_GC_GUARD(string);
     }
 
     return length;