From 12268dc3ef42c1836fc9c3d89114fbef21a24b7c Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Fri, 24 Oct 2025 23:21:19 +0900
Subject: [PATCH] revert "array.c: hoist RARRAY_PTR calls in comparison
 operator"; fix #6652

this reverts commit 04af58db89 which caused use-after-free vulnerability.
cached array pointers become invalid when mrb_cmp() executes user's <=>
method that can modify arrays during iteration

Co-authored-by: Claude <noreply@anthropic.com>
---
 src/array.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/array.c b/src/array.c
index a73e9a98a..fd043786a 100644
--- a/src/array.c
+++ b/src/array.c
@@ -1956,11 +1956,8 @@ mrb_ary_cmp(mrb_state *mrb, mrb_value ary1)
   if (mrb_obj_equal(mrb, ary1, ary2)) return mrb_fixnum_value(0);
   if (!mrb_array_p(ary2)) return mrb_nil_value();
 
-  /* Hoist pointer retrieval outside loop to avoid repeated conditionals */
-  mrb_value *ptr1 = RARRAY_PTR(ary1);
-  mrb_value *ptr2 = RARRAY_PTR(ary2);
   for (mrb_int i=0; i<RARRAY_LEN(ary1) && i<RARRAY_LEN(ary2); i++) {
-    mrb_int n = mrb_cmp(mrb, ptr1[i], ptr2[i]);
+    mrb_int n = mrb_cmp(mrb, RARRAY_PTR(ary1)[i], RARRAY_PTR(ary2)[i]);
     if (n == -2) return mrb_nil_value();
     if (n != 0) return mrb_fixnum_value(n);
   }