From 29496c9931b8c01212e68a2c9a0136b3ae3ef8d1 Mon Sep 17 00:00:00 2001
From: dearblue <dearblue@users.osdn.me>
Date: Tue, 3 Sep 2024 21:25:31 +0900
Subject: [PATCH] Fix use-after-free for `Array#<=>`

The `mrb_ary_cmp()` function calls `mrb_cmp()` for comparison, but `mrb_cmp()` may call the `obj.<=>` method internally.
If a user-defined `<=>` method is called and the array object under comparison is expanded or reduced, a reference to an invalid address may subsequently be made.
---
 src/array.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/array.c b/src/array.c
index 9e90509f2..4584738e7 100644
--- a/src/array.c
+++ b/src/array.c
@@ -1493,15 +1493,12 @@ mrb_ary_cmp(mrb_state *mrb, mrb_value ary1)
   if (mrb_obj_equal(mrb, ary1, ary2)) return mrb_fixnum_value(0);
   if (!mrb_array_p(ary2)) return mrb_nil_value();
 
-  mrb_int len = RARRAY_LEN(ary1);
-  mrb_int n =  RARRAY_LEN(ary2);
-  if (len > n) len = n;
-  for (mrb_int i=0; i<len; i++) {
-    n = mrb_cmp(mrb, RARRAY_PTR(ary1)[i], RARRAY_PTR(ary2)[i]);
+  for (mrb_int i=0; i<RARRAY_LEN(ary1) && i<RARRAY_LEN(ary2); i++) {
+    mrb_int n = mrb_cmp(mrb, RARRAY_PTR(ary1)[i], RARRAY_PTR(ary2)[i]);
     if (n == -2) return mrb_nil_value();
     if (n != 0) return mrb_fixnum_value(n);
   }
-  len = RARRAY_LEN(ary1) - RARRAY_LEN(ary2);
+  mrb_int len = RARRAY_LEN(ary1) - RARRAY_LEN(ary2);
   if (len == 0) return mrb_fixnum_value(0);
   else if (len > 0) return mrb_fixnum_value(1);
   else return mrb_fixnum_value(-1);