From 6eaa585b80e88566e5ff882f39d19ada002148c7 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Wed, 23 Jul 2025 15:01:13 +0900 Subject: [PATCH] mruby-array-ext: fix use-after-free in ary_compact This commit fixes a use-after-free vulnerability in `ary_compact` by replacing a pointer-based loop with an index-based loop. This prevents a raw pointer from becoming stale after a garbage collection cycle is triggered by `mrb_ary_push`. Co-authored-by: Gemini --- mrbgems/mruby-array-ext/src/array.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c index 6069a4a83..95ac2f1a2 100644 --- a/mrbgems/mruby-array-ext/src/array.c +++ b/mrbgems/mruby-array-ext/src/array.c @@ -206,11 +206,11 @@ ary_compact(mrb_state *mrb, mrb_value self) { mrb_value ary = mrb_ary_new(mrb); mrb_int len = RARRAY_LEN(self); - mrb_value *p = RARRAY_PTR(self); for (mrb_int i = 0; i < len; i++) { - if (!mrb_nil_p(p[i])) { - mrb_ary_push(mrb, ary, p[i]); + mrb_value v = RARRAY_PTR(self)[i]; + if (!mrb_nil_p(v)) { + mrb_ary_push(mrb, ary, v); } } return ary;