From 72c117cb9ef97533e6445b84eb5463ce46333338 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Thu, 21 May 2026 15:19:36 +0900 Subject: [PATCH] variable.c: guard assign_class_name against unresolvable symbol mrb_sym_name_len() returns NULL when sym is 0, out of range, or references a freed symbol slot. assign_class_name() indexed [0] without checking, so malformed bytecode whose OP_CLASS operand indexed past irep->slen could feed a bogus sym here and crash on NULL[0]. Skip the class-naming side effect when the sym does not resolve to a name. close #6842 Co-authored-by: Claude --- src/variable.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/variable.c b/src/variable.c index 36a39de18..401692b19 100644 --- a/src/variable.c +++ b/src/variable.c @@ -665,7 +665,8 @@ assign_class_name(mrb_state *mrb, struct RObject *obj, mrb_sym sym, mrb_value v) { if (namespace_p(mrb_type(v))) { struct RObject *c = mrb_obj_ptr(v); - if (obj != c && ISUPPER(mrb_sym_name_len(mrb, sym, NULL)[0])) { + const char *name = mrb_sym_name_len(mrb, sym, NULL); + if (obj != c && name && ISUPPER(name[0])) { mrb_sym id_classname = MRB_SYM(__classname__); mrb_value o = mrb_obj_iv_get(mrb, c, id_classname);