admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-array-ext: revert unsafe length caching in ary_intersect_p; ref #6652

Browse Source 
both hash and linear paths cache array lengths before loops that call
mrb_eql() and mrb_equal(), which can execute user code that modifies
arrays, causing out-of-bounds access.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-10-25 08:35:25 +09:00
parent 56a0bdf493
commit bd3b5f87fb
1 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-array-ext/src/array.c
+3 -6
View File
@@ -794,8 +794,7 @@ ary_intersect_p(mrb_state *mrb, mrb_value self)
ary_init_temp_set(mrb, set, RARRAY_LEN(shorter_ary));
ary_populate_temp_set(mrb, set, shorter_ary);
mrb_int longer_len = RARRAY_LEN(longer_ary);
for (mrb_int i = 0; i < longer_len; i++) {
for (mrb_int i = 0; i < RARRAY_LEN(longer_ary); i++) {
khiter_t k = kh_get(ary_set, mrb, set, RARRAY_PTR(longer_ary)[i]);
if (k != kh_end(set)) {
ary_destroy_temp_set(mrb, set);
@@ -806,10 +805,8 @@ ary_intersect_p(mrb_state *mrb, mrb_value self)
ary_destroy_temp_set(mrb, set);
}
else {
mrb_int longer_len = RARRAY_LEN(longer_ary);
for (mrb_int i = 0; i < longer_len; i++) {
mrb_int shorter_len = RARRAY_LEN(shorter_ary);
for (mrb_int j = 0; j < shorter_len; j++) {
for (mrb_int i = 0; i < RARRAY_LEN(longer_ary); i++) {
for (mrb_int j = 0; j < RARRAY_LEN(shorter_ary); j++) {
if (mrb_equal(mrb, RARRAY_PTR(longer_ary)[i], RARRAY_PTR(shorter_ary)[j])) {
return mrb_true_value();
}