admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Get object properties after mrb_get_args()

Browse Source 
ref. #5613

I checked with Valgrind, and the methods that can cause use-after-free are `Array#rotate`, `Array#rotate!`, and `String#byteslice`.
Since `String#rindex` uses `RSTRING_LEN()` indirectly inside the function, no reference to the out-of-bounds range is generated.
This commit is contained in:
dearblue
2021-12-30 22:34:22 +09:00
parent 41e8b210b8
commit a137ef12f9
2 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/string.c
+7 -3
View File
@@ -2047,9 +2047,11 @@ static mrb_value
mrb_str_rindex(mrb_state *mrb, mrb_value str)
{
mrb_value sub;
mrb_int pos, len = RSTRING_CHAR_LEN(str);
mrb_int pos;
int argc = mrb_get_args(mrb, "S|i", &sub, &pos);
mrb_int len = RSTRING_CHAR_LEN(str);
if (mrb_get_args(mrb, "S|i", &sub, &pos) == 1) {
if (argc == 1) {
pos = len;
}
else {
@@ -2828,16 +2830,18 @@ static mrb_value
mrb_str_byteslice(mrb_state *mrb, mrb_value str)
{
mrb_value a1;
mrb_int str_len = RSTRING_LEN(str), beg, len;
mrb_int str_len, beg, len;
mrb_bool empty = TRUE;
len = mrb_get_argc(mrb);
switch (len) {
case 2:
mrb_get_args(mrb, "ii", &beg, &len);
str_len = RSTRING_LEN(str);
break;
case 1:
a1 = mrb_get_arg1(mrb);
str_len = RSTRING_LEN(str);
if (mrb_range_p(a1)) {
if (mrb_range_beg_len(mrb, a1, &beg, &len, str_len, TRUE) != MRB_RANGE_OK) {
return mrb_nil_value();