admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

The bidx saved in env may be useless; fix #3841

Browse Source 
When `block_given?` is called from a block given to `define_method`
as a method body, the `bidx` may not be within `env` saved closure.
In this case, it causes heap buffer overflow.
This commit is contained in:
Yukihiro "Matz" Matsumoto
2017-11-04 03:01:37 +09:00
parent e7fe6ee263
commit ab27abe083
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/kernel.c
+8 -2
View File
@@ -153,13 +153,19 @@ mrb_f_block_given_p_m(mrb_state *mrb, mrb_value self)
if (p == NULL) return mrb_false_value();
if (MRB_PROC_ENV_P(p)) {
struct REnv *e = MRB_PROC_ENV(p);
int bidx;
/* top-level does not have block slot (always false) */
if (e->stack == mrb->c->stbase)
return mrb_false_value();
/* use saved block arg position */
bp = &e->stack[MRB_ENV_BIDX(e)];
bidx = MRB_ENV_BIDX(e);
/* bidx may be useless (e.g. define_method) */
if (bidx >= MRB_ENV_STACK_LEN(e))
return mrb_false_value();
bp = &e->stack[bidx];
}
if (ci && ci->argc > 0) {
else if (ci && ci->argc > 0) {
bp += ci->argc;
}
if (mrb_nil_p(*bp))