admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

revert "array.c: hoist RARRAY_PTR calls in comparison operator"; fix #6652

Browse Source 
this reverts commit 04af58db89 which caused use-after-free vulnerability.
cached array pointers become invalid when mrb_cmp() executes user's <=>
method that can modify arrays during iteration

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-10-24 23:21:19 +09:00
parent b135601e6a
commit 12268dc3ef
1 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/array.c
+1 -4
View File
@@ -1956,11 +1956,8 @@ mrb_ary_cmp(mrb_state *mrb, mrb_value ary1)
if (mrb_obj_equal(mrb, ary1, ary2)) return mrb_fixnum_value(0);
if (!mrb_array_p(ary2)) return mrb_nil_value();
/* Hoist pointer retrieval outside loop to avoid repeated conditionals */
mrb_value *ptr1 = RARRAY_PTR(ary1);
mrb_value *ptr2 = RARRAY_PTR(ary2);
for (mrb_int i=0; i<RARRAY_LEN(ary1) && i<RARRAY_LEN(ary2); i++) {
mrb_int n = mrb_cmp(mrb, ptr1[i], ptr2[i]);
mrb_int n = mrb_cmp(mrb, RARRAY_PTR(ary1)[i], RARRAY_PTR(ary2)[i]);
if (n == -2) return mrb_nil_value();
if (n != 0) return mrb_fixnum_value(n);
}