mruby-array-ext: add type check in __product_group to prevent crash

the internal method __product_group assumes all elements in the arys
argument are Arrays, but when called directly (e.g., via send or fuzzing),
non-array values can cause segfault. add type check before accessing with
RARRAY_LEN to convert crash to proper TypeError.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-11-17 08:50:40 +09:00
parent d570ef257c
commit 431d4bb51d
+1
View File
@@ -1360,6 +1360,7 @@ ary_product_group(mrb_state *mrb, mrb_value self_ary)
while (j > 0) {
j -= 1;
mrb_value a = RARRAY_PTR(arys_ary)[j]; // arys[j]
mrb_check_type(mrb, a, MRB_TT_ARRAY);
mrb_int b = RARRAY_LEN(a); // a.size
mrb_ary_set(mrb, group, j + 1, RARRAY_PTR(a)[n % b]);
n /= b;