admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix use after free in File#initilialize_copy; fix #4001

Browse Source 
The bug and the fix were reported by https://hackerone.com/pnoltof
This commit is contained in:
Yukihiro "Matz" Matsumoto
2018-04-17 09:57:41 +09:00
parent fabc460880
commit b51b21fc63
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-io/src/io.c
+1 -1
View File
@@ -561,13 +561,13 @@ mrb_io_initialize_copy(mrb_state *mrb, mrb_value copy)
mrb_bool failed = TRUE;
mrb_get_args(mrb, "o", &orig);
fptr_orig = io_get_open_fptr(mrb, orig);
fptr_copy = (struct mrb_io *)DATA_PTR(copy);
if (fptr_copy != NULL) {
fptr_finalize(mrb, fptr_copy, FALSE);
mrb_free(mrb, fptr_copy);
}
fptr_copy = (struct mrb_io *)mrb_io_alloc(mrb);
fptr_orig = io_get_open_fptr(mrb, orig);
DATA_TYPE(copy) = &mrb_io_type;
DATA_PTR(copy) = fptr_copy;