Ruby

Fixed heap-use-after-free

• string.c (rb_str_sub_bang): retrieves a pointer to the
  replacement string buffer just before using it, for the case of
  replacement with the receiver string itself. [Bug #16105]