From bd3b5f87fb47cbdd1e5b7a2a2d7af59bf58ed058 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 25 Oct 2025 08:35:25 +0900 Subject: [PATCH] mruby-array-ext: revert unsafe length caching in ary_intersect_p; ref #6652 both hash and linear paths cache array lengths before loops that call mrb_eql() and mrb_equal(), which can execute user code that modifies arrays, causing out-of-bounds access. Co-authored-by: Claude --- mrbgems/mruby-array-ext/src/array.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c index d3fb89123..426d95bb3 100644 --- a/mrbgems/mruby-array-ext/src/array.c +++ b/mrbgems/mruby-array-ext/src/array.c @@ -794,8 +794,7 @@ ary_intersect_p(mrb_state *mrb, mrb_value self) ary_init_temp_set(mrb, set, RARRAY_LEN(shorter_ary)); ary_populate_temp_set(mrb, set, shorter_ary); - mrb_int longer_len = RARRAY_LEN(longer_ary); - for (mrb_int i = 0; i < longer_len; i++) { + for (mrb_int i = 0; i < RARRAY_LEN(longer_ary); i++) { khiter_t k = kh_get(ary_set, mrb, set, RARRAY_PTR(longer_ary)[i]); if (k != kh_end(set)) { ary_destroy_temp_set(mrb, set); @@ -806,10 +805,8 @@ ary_intersect_p(mrb_state *mrb, mrb_value self) ary_destroy_temp_set(mrb, set); } else { - mrb_int longer_len = RARRAY_LEN(longer_ary); - for (mrb_int i = 0; i < longer_len; i++) { - mrb_int shorter_len = RARRAY_LEN(shorter_ary); - for (mrb_int j = 0; j < shorter_len; j++) { + for (mrb_int i = 0; i < RARRAY_LEN(longer_ary); i++) { + for (mrb_int j = 0; j < RARRAY_LEN(shorter_ary); j++) { if (mrb_equal(mrb, RARRAY_PTR(longer_ary)[i], RARRAY_PTR(shorter_ary)[j])) { return mrb_true_value(); }