From 2cbfc2f35033ba4cdd80e4be43826b907cd1d0dc Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 26 Mar 2022 21:06:02 +0900 Subject: [PATCH] vm.c: vm.c: stack may be reallocated in functions calls; aaa28a5 `mrb_range_new()` also calls VM recursively. Address CVE-2022-1106 --- src/vm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/vm.c b/src/vm.c index bb804be68..e4a6cd67c 100644 --- a/src/vm.c +++ b/src/vm.c @@ -2831,13 +2831,15 @@ RETRY_TRY_BLOCK: } CASE(OP_RANGE_INC, B) { - regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], FALSE); + mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], FALSE); + regs[a] = v; mrb_gc_arena_restore(mrb, ai); NEXT; } CASE(OP_RANGE_EXC, B) { - regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], TRUE); + mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], TRUE); + regs[a] = v; mrb_gc_arena_restore(mrb, ai); NEXT; }