mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
mruby-array-ext: add type check in __product_group to prevent crash
the internal method __product_group assumes all elements in the arys argument are Arrays, but when called directly (e.g., via send or fuzzing), non-array values can cause segfault. add type check before accessing with RARRAY_LEN to convert crash to proper TypeError. Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -1360,6 +1360,7 @@ ary_product_group(mrb_state *mrb, mrb_value self_ary)
|
||||
while (j > 0) {
|
||||
j -= 1;
|
||||
mrb_value a = RARRAY_PTR(arys_ary)[j]; // arys[j]
|
||||
mrb_check_type(mrb, a, MRB_TT_ARRAY);
|
||||
mrb_int b = RARRAY_LEN(a); // a.size
|
||||
mrb_ary_set(mrb, group, j + 1, RARRAY_PTR(a)[n % b]);
|
||||
n /= b;
|
||||
|
||||
Reference in New Issue
Block a user