From 17c671dce821433feae56f37d328460c39091dd4 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Wed, 23 Jul 2025 15:19:57 +0900 Subject: [PATCH] mruby-array-ext: fix use-after-free in ary_compact_bang This commit fixes a use-after-free vulnerability in `ary_compact_bang` by replacing pointer-based iteration with index-based loops. This prevents raw pointers from becoming stale after a garbage collection cycle is triggered by `mrb_ary_modify`. Co-authored-by: Gemini --- mrbgems/mruby-array-ext/src/array.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c index b18fb90d5..060134995 100644 --- a/mrbgems/mruby-array-ext/src/array.c +++ b/mrbgems/mruby-array-ext/src/array.c @@ -235,10 +235,10 @@ ary_compact_bang(mrb_state *mrb, mrb_value self) mrb_int len = ARY_LEN(a); mrb_ary_modify(mrb, a); - mrb_value *p = ARY_PTR(a); + /* a is still valid here, as mrb_ary_modify only modifies the RArray struct, not reallocates it */ for (i = 0; i < len; i++) { - if (!mrb_nil_p(p[i])) { - if (i != j) p[j] = p[i]; + if (!mrb_nil_p(RARRAY_PTR(self)[i])) { + if (i != j) RARRAY_PTR(self)[j] = RARRAY_PTR(self)[i]; j++; } }