From af92f15d4baa20f562b6b3cfb3fe0e4b805a9c55 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Mon, 21 Jul 2025 17:17:25 +0900 Subject: [PATCH] mruby-string-ext: fix use-after-free bug in String#insert --- mrbgems/mruby-string-ext/src/string.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/mrbgems/mruby-string-ext/src/string.c b/mrbgems/mruby-string-ext/src/string.c index 00d04c560..016cd920b 100644 --- a/mrbgems/mruby-string-ext/src/string.c +++ b/mrbgems/mruby-string-ext/src/string.c @@ -2156,9 +2156,8 @@ str_insert(mrb_state *mrb, mrb_value self) mrb_get_args(mrb, "iS", &idx, &str_to_insert); struct RString *s = mrb_str_ptr(self); - mrb_int self_len = RSTRING_LEN(self); + mrb_int self_len = RSTR_LEN(s); mrb_int insert_len = RSTRING_LEN(str_to_insert); - const char *insert_ptr = RSTRING_PTR(str_to_insert); mrb_check_frozen(mrb, s); @@ -2175,7 +2174,7 @@ str_insert(mrb_state *mrb, mrb_value self) char *p = RSTRING_PTR(self); memmove(p + idx + insert_len, p + idx, self_len - idx); - memcpy(p + idx, insert_ptr, insert_len); + memcpy(p + idx, RSTRING_PTR(str_to_insert), insert_len); return self; }