From 8441eaf633ef6c001c929e6a4d36cfb41bb03a75 Mon Sep 17 00:00:00 2001
From: dearblue <dearblue@gmx.com>
Date: Thu, 19 Mar 2026 22:50:37 +0900
Subject: [PATCH] Fixed "Out-of-bounds Read" and "Divide-by-Zero" in
 `ary_product_group()`

Reproduction:

  - Out-of-bounds Read

    ```console
    % build/host/bin/mruby -e '([nil] * 256).__product_group([[nil] * 256], 1 << 32, 256)'
    zsh: segmentation fault (core dumped)  build/host/bin/mruby -e
    ```

  - Divide-by-Zero

    ```console
    % build/host/bin/mruby -e '([nil] * 256).__product_group([[]], 1 << 32, 256)'
    zsh: floating point exception (core dumped)  build/host/bin/mruby -e '([nil] * 256).__product_group([[]], 1 << 32, 256)'
    ```
---
 mrbgems/mruby-array-ext/src/array.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c
index f31e58758..16da8ed70 100644
--- a/mrbgems/mruby-array-ext/src/array.c
+++ b/mrbgems/mruby-array-ext/src/array.c
@@ -1395,9 +1395,15 @@ ary_product_group(mrb_state *mrb, mrb_value self_ary)
     mrb_value a = RARRAY_PTR(arys_ary)[j]; // arys[j]
     mrb_check_type(mrb, a, MRB_TT_ARRAY);
     mrb_int b = RARRAY_LEN(a);             // a.size
+    if (b <= 0) {
+      mrb_raise(mrb, E_ARGUMENT_ERROR, "cannot compute product with an empty array");
+    }
     mrb_ary_set(mrb, group, j + 1, RARRAY_PTR(a)[n % b]);
     n /= b;
   }
+  if (n >= RARRAY_LEN(self_ary)) {
+    mrb_raise(mrb, E_INDEX_ERROR, "index out of range");
+  }
   mrb_ary_set(mrb, group, 0, RARRAY_PTR(self_ary)[n]);
 
   return group;