admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

variable.c: guard assign_class_name against unresolvable symbol

Browse Source 
mrb_sym_name_len() returns NULL when sym is 0, out of range, or
references a freed symbol slot. assign_class_name() indexed [0]
without checking, so malformed bytecode whose OP_CLASS operand
indexed past irep->slen could feed a bogus sym here and crash on
NULL[0]. Skip the class-naming side effect when the sym does not
resolve to a name.

close #6842

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-05-21 15:19:36 +09:00
parent 465e634d48
commit 72c117cb9e
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/variable.c
+2 -1
View File
@@ -665,7 +665,8 @@ assign_class_name(mrb_state *mrb, struct RObject *obj, mrb_sym sym, mrb_value v)
{
if (namespace_p(mrb_type(v))) {
struct RObject *c = mrb_obj_ptr(v);
if (obj != c && ISUPPER(mrb_sym_name_len(mrb, sym, NULL)[0])) {
const char *name = mrb_sym_name_len(mrb, sym, NULL);
if (obj != c && name && ISUPPER(name[0])) {
mrb_sym id_classname = MRB_SYM(__classname__);
mrb_value o = mrb_obj_iv_get(mrb, c, id_classname);