From 5640e1bd9e59b1837f1f03e952027f09b22207f7 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Wed, 23 Jul 2025 15:03:43 +0900 Subject: [PATCH] mruby-array-ext: fix use-after-free in ary_rotate This commit fixes a use-after-free vulnerability in `ary_rotate` by replacing a pointer-based loop with an index-based loop. This prevents a raw pointer from becoming stale after a garbage collection cycle is triggered by `mrb_ary_push`. Co-authored-by: Gemini --- mrbgems/mruby-array-ext/src/array.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c index 95ac2f1a2..46656f2e8 100644 --- a/mrbgems/mruby-array-ext/src/array.c +++ b/mrbgems/mruby-array-ext/src/array.c @@ -272,7 +272,6 @@ ary_rotate(mrb_state *mrb, mrb_value self) mrb_value ary = mrb_ary_new(mrb); mrb_int len = RARRAY_LEN(self); - mrb_value *p = RARRAY_PTR(self); mrb_int idx; if (len <= 0) return ary; @@ -283,7 +282,7 @@ ary_rotate(mrb_state *mrb, mrb_value self) idx = count % len; } for (mrb_int i = 0; i