admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-array-ext: fix use-after-free in ary_compact_bang

Browse Source 
This commit fixes a use-after-free vulnerability in `ary_compact_bang` by
replacing pointer-based iteration with index-based loops. This prevents raw
pointers from becoming stale after a garbage collection cycle is triggered by
`mrb_ary_modify`.

Co-authored-by: Gemini <gemini@google.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-07-23 15:19:57 +09:00
parent f88847841a
commit 17c671dce8
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-array-ext/src/array.c
+3 -3
View File
@@ -235,10 +235,10 @@ ary_compact_bang(mrb_state *mrb, mrb_value self)
mrb_int len = ARY_LEN(a);
mrb_ary_modify(mrb, a);
mrb_value *p = ARY_PTR(a);
/* a is still valid here, as mrb_ary_modify only modifies the RArray struct, not reallocates it */
for (i = 0; i < len; i++) {
if (!mrb_nil_p(p[i])) {
if (i != j) p[j] = p[i];
if (!mrb_nil_p(RARRAY_PTR(self)[i])) {
if (i != j) RARRAY_PTR(self)[j] = RARRAY_PTR(self)[i];
j++;
}
}