mruby-compiler: fix crash in pattern matching with string literal

The p_value grammar rule passed raw tSTRING token (a (len . str) cons
cell) directly to new_pat_value() without wrapping it as a proper AST
node. When codegen processed this malformed node, it read the length
field as the node type, causing misinterpretation and crash.

Wrap tSTRING with new_str(p, list1($1)) to create a proper NODE_STR,
consistent with how the primary:string rule handles strings.

Found by ClusterFuzz (oss-fuzz/mruby_fuzzer).

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-12-29 13:34:13 +09:00
parent e19b107642
commit 4fc81e8ea0
2 changed files with 2 additions and 2 deletions
+1 -1
View File
@@ -3986,7 +3986,7 @@ p_value : p_var
}
| tSTRING
{
$$ = new_pat_value(p, $1);
$$ = new_pat_value(p, new_str(p, list1($1)));
}
| keyword_nil
{
+1 -1
View File
@@ -10540,7 +10540,7 @@ yyreduce:
case 456: /* p_value: tSTRING */
#line 3988 "mrbgems/mruby-compiler/core/parse.y"
{
(yyval.nd) = new_pat_value(p, (yyvsp[0].nd));
(yyval.nd) = new_pat_value(p, new_str(p, list1((yyvsp[0].nd))));
}
#line 10546 "mrbgems/mruby-compiler/core/y.tab.c"
break;