From 66f438d8fe69b66b0adf2d515270a972c7d6644f Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Fri, 22 May 2026 07:08:11 +0900 Subject: [PATCH] mruby-bin-debugger: return on OOM in mrb_debug_set_break_method mrb_debug_set_break_method() freed set_class after mrdb_strdup() of method_name failed but did not return. Execution continued into alloc_breakpoint(), which on failure double-freed set_class, or on success stored the dangling pointer in the breakpoint table for later use-after-free. Return MRB_DEBUG_NOBUF immediately after the free. mrdb_strdup uses mrb_malloc_simple which returns NULL on OOM (it does not raise), so the NULL check is reachable in practice. close #6851 Co-authored-by: Claude --- mrbgems/mruby-bin-debugger/tools/mrdb/apibreak.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mrbgems/mruby-bin-debugger/tools/mrdb/apibreak.c b/mrbgems/mruby-bin-debugger/tools/mrdb/apibreak.c index 942b9c4cd..6eb4973f1 100644 --- a/mrbgems/mruby-bin-debugger/tools/mrdb/apibreak.c +++ b/mrbgems/mruby-bin-debugger/tools/mrdb/apibreak.c @@ -239,6 +239,7 @@ mrb_debug_set_break_method(mrb_state *mrb, mrb_debug_context *dbg, const char *c set_method = mrdb_strdup(mrb, method_name); if (set_method == NULL) { mrb_free(mrb, set_class); + return MRB_DEBUG_NOBUF; } index = alloc_breakpoint(dbg, MRB_DEBUG_BPTYPE_METHOD);