From 20552fe176d5f8373716a78d686e5fdd3aa72537 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 17 Jun 2023 10:55:55 +0900 Subject: [PATCH] hash.c (mrb_hash_foreach): wrap function call with h_check_modified If the iterating hash is modified in the function, h_each loop may crash accessing modified (and probably deallocated) internal data. --- src/hash.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/hash.c b/src/hash.c index 5e52d9b8f..ee3c43d5c 100644 --- a/src/hash.c +++ b/src/hash.c @@ -273,7 +273,7 @@ HT_ASSERT_SAFE_READ(ea_capa); } \ code; \ if (flags__ != (h__->flags & mask__) || \ - tbl__ != h__->hsh.ht || \ + tbl__ != h__->hsh.ht || \ ((H_CHECK_MODIFIED_USE_HT_EA_CAPA_FOR_AR || h_ht_p(h__)) && \ ht_ea_capa__ != ht_ea_capa(h__)) || \ ((H_CHECK_MODIFIED_USE_HT_EA_FOR_AR || h_ht_p(h__)) && \ @@ -1109,7 +1109,11 @@ MRB_API void mrb_hash_foreach(mrb_state *mrb, struct RHash *h, mrb_hash_foreach_func *func, void *data) { h_each(h, entry, { - if (func(mrb, entry->key, entry->val, data) != 0) return; + int n; + h_check_modified(mrb, h, { + n = func(mrb, entry->key, entry->val, data); + }); + if (n != 0) return; }); }