admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-array-ext: fix use-after-free in ary_compact

Browse Source 
This commit fixes a use-after-free vulnerability in `ary_compact` by replacing
a pointer-based loop with an index-based loop. This prevents a raw pointer from
becoming stale after a garbage collection cycle is triggered by `mrb_ary_push`.

Co-authored-by: Gemini <gemini@google.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-07-23 15:01:13 +09:00
parent 6c2a25aa1a
commit 6eaa585b80
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-array-ext/src/array.c
+3 -3
View File
@@ -206,11 +206,11 @@ ary_compact(mrb_state *mrb, mrb_value self)
{
mrb_value ary = mrb_ary_new(mrb);
mrb_int len = RARRAY_LEN(self);
mrb_value *p = RARRAY_PTR(self);
for (mrb_int i = 0; i < len; i++) {
if (!mrb_nil_p(p[i])) {
mrb_ary_push(mrb, ary, p[i]);
mrb_value v = RARRAY_PTR(self)[i];
if (!mrb_nil_p(v)) {
mrb_ary_push(mrb, ary, v);
}
}
return ary;