admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-string-ext: fix use-after-free bug in String#insert

Browse Source
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-07-21 17:17:25 +09:00
parent 8b39a57be7
commit af92f15d4b
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-string-ext/src/string.c
+2 -3
View File
@@ -2156,9 +2156,8 @@ str_insert(mrb_state *mrb, mrb_value self)
mrb_get_args(mrb, "iS", &idx, &str_to_insert);
struct RString *s = mrb_str_ptr(self);
mrb_int self_len = RSTRING_LEN(self);
mrb_int self_len = RSTR_LEN(s);
mrb_int insert_len = RSTRING_LEN(str_to_insert);
const char *insert_ptr = RSTRING_PTR(str_to_insert);
mrb_check_frozen(mrb, s);
@@ -2175,7 +2174,7 @@ str_insert(mrb_state *mrb, mrb_value self)
char *p = RSTRING_PTR(self);
memmove(p + idx + insert_len, p + idx, self_len - idx);
memcpy(p + idx, insert_ptr, insert_len);
memcpy(p + idx, RSTRING_PTR(str_to_insert), insert_len);
return self;
}