Check if the value is fixnum before mrb_funcall(); fix #3476

The issue is reported by https://hackerone.com/aerodudrizzt
This commit is contained in:
Yukihiro "Matz" Matsumoto
2017-02-28 09:13:51 +09:00
parent a76dc04aa8
commit bdac7dfae8
+2 -2
View File
@@ -959,8 +959,8 @@ mrb_str_cmp_m(mrb_state *mrb, mrb_value str1)
else {
mrb_value tmp = mrb_funcall(mrb, str2, "<=>", 1, str1);
if (mrb_nil_p(tmp)) return mrb_nil_value();
if (!mrb_fixnum(tmp)) {
if (!mrb_nil_p(tmp)) return mrb_nil_value();
if (!mrb_fixnum_p(tmp)) {
return mrb_funcall(mrb, mrb_fixnum_value(0), "-", 1, tmp);
}
result = -mrb_fixnum(tmp);