From 1c7a0d4e96aab2f7b08d138d826dd38330f64b20 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sun, 16 Nov 2025 19:38:33 +0900 Subject: [PATCH] vm.c: add type check before calling mrb_hash_size() on keyword dict the keyword argument handling code was checking if kdict is not nil before calling mrb_hash_size(), but didn't verify it's actually a hash. malformed bytecode could cause a non-hash value to be stored in the keyword dictionary register, leading to a NULL pointer dereference in h_size(). add mrb_hash_p() check to prevent the crash. Co-authored-by: Claude --- src/vm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/vm.c b/src/vm.c index 26e59e0a4..ca14aef20 100644 --- a/src/vm.c +++ b/src/vm.c @@ -2440,7 +2440,7 @@ RETRY_TRY_BLOCK: kdict = regs[mrb_ci_kidx(ci)]; } if (!kd) { - if (!mrb_nil_p(kdict) && mrb_hash_size(mrb, kdict) > 0) { + if (!mrb_nil_p(kdict) && mrb_hash_p(kdict) && mrb_hash_size(mrb, kdict) > 0) { if (argc < 14) { ci->n++; argc++; /* include kdict in normal arguments */