Ruby

merge revision(s) d5c33364e3c0efb15e11df417c925afee2cdb9c9: [Backport #16105]
Fixed heap-use-after-free

 * string.c (rb_str_sub_bang): retrieves a pointer to the replacement string buffer just before using it, for the case of replacement with the receiver string itself. [Bug #16105] 

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67773 b2dd03c8-39d4-4d8f-98ff-823fe69b080e