Use-after-free is possible graphql-c_parser if Bison moves GraphQL-Ruby AST nodes into the heap. Bison's heap is not scanned by Ruby's garbage collector, so if GC runs during this stage, Ruby determines those objects to be dead. Later, however, graphql-c_parser uses those objects again while continuing to parse.

Patched versions use Bison's YYSTACK_USE_ALLOCA 1 configuration to use stack memory instead.

This issue was reported by PlatformSecurity.