From 8a73faf61ed65e75c9a07d39f65e6cf88743bfa3 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 2 May 2026 10:41:45 +0900 Subject: [PATCH] vm.c: refresh ci after mrb_const_set in OP_SETCONST mrb_const_set may invoke const_added via mrb_funcall_argv, which re-enters the VM and can reallocate cibase. This invalidates the local ci pointer (and thus the regs macro that expands to ci->stack), causing a use-after-free on the next opcode dispatch. OP_SETMCNST and the OP_GET* / OP_*IDX opcodes already follow this pattern; align OP_SETCONST with them. Reported by OSS-Fuzz (clusterfuzz testcase 5886006653157376). Co-authored-by: Claude --- src/vm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/vm.c b/src/vm.c index 8664df1cf..b1de67637 100644 --- a/src/vm.c +++ b/src/vm.c @@ -2477,6 +2477,7 @@ RETRY_TRY_BLOCK: struct RClass *c = MRB_PROC_TARGET_CLASS(ci->proc); if (!c) c = mrb->object_class; mrb_const_set(mrb, mrb_obj_value(c), irep->syms[b], regs[a]); + ci = mrb->c->ci; NEXT; }