From 431d4bb51d220e33d5a1e85ba71a06ec4fdab288 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Mon, 17 Nov 2025 08:50:40 +0900 Subject: [PATCH] mruby-array-ext: add type check in __product_group to prevent crash the internal method __product_group assumes all elements in the arys argument are Arrays, but when called directly (e.g., via send or fuzzing), non-array values can cause segfault. add type check before accessing with RARRAY_LEN to convert crash to proper TypeError. Co-authored-by: Claude --- mrbgems/mruby-array-ext/src/array.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c index ddd4bc858..fddc65596 100644 --- a/mrbgems/mruby-array-ext/src/array.c +++ b/mrbgems/mruby-array-ext/src/array.c @@ -1360,6 +1360,7 @@ ary_product_group(mrb_state *mrb, mrb_value self_ary) while (j > 0) { j -= 1; mrb_value a = RARRAY_PTR(arys_ary)[j]; // arys[j] + mrb_check_type(mrb, a, MRB_TT_ARRAY); mrb_int b = RARRAY_LEN(a); // a.size mrb_ary_set(mrb, group, j + 1, RARRAY_PTR(a)[n % b]); n /= b;