admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-bin-debugger: return on OOM in mrb_debug_set_break_method

Browse Source 
mrb_debug_set_break_method() freed set_class after mrdb_strdup() of
method_name failed but did not return. Execution continued into
alloc_breakpoint(), which on failure double-freed set_class, or on
success stored the dangling pointer in the breakpoint table for later
use-after-free. Return MRB_DEBUG_NOBUF immediately after the free.

mrdb_strdup uses mrb_malloc_simple which returns NULL on OOM (it does
not raise), so the NULL check is reachable in practice.

close #6851

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-05-22 07:08:11 +09:00
parent 4507b4a633
commit 66f438d8fe
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-bin-debugger/tools/mrdb/apibreak.c
+1
View File
@@ -239,6 +239,7 @@ mrb_debug_set_break_method(mrb_state *mrb, mrb_debug_context *dbg, const char *c
set_method = mrdb_strdup(mrb, method_name);
if (set_method == NULL) {
mrb_free(mrb, set_class);
return MRB_DEBUG_NOBUF;
}
index = alloc_breakpoint(dbg, MRB_DEBUG_BPTYPE_METHOD);