mruby-compiler: fix uninitialized memory in realloc_pool_str()

when converting a shared/static string (IREP_TT_SSTR) to heap-allocated
(IREP_TT_STR), copy the original content to the new buffer.

previously, the original content was lost when allocating new memory,
leaving the first bytes uninitialized. this caused find_pool_str() to
read uninitialized memory via memcmp() when searching for duplicate
strings.

reported by OSS-Fuzz.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-01-08 12:13:08 +09:00
parent ad5301970f
commit c46f9e0793
+3
View File
@@ -1242,8 +1242,11 @@ static void
realloc_pool_str(codegen_scope *s, mrb_irep_pool *p, mrb_int len)
{
char *str;
mrb_int olen = p->tt >> 2; /* original length */
if ((p->tt & 3) == IREP_TT_SSTR) { /* Check if it's a shared/static string */
const char *old = p->u.str;
str = (char*)mrbc_malloc(len+1); /* Allocate new memory if it was shared */
memcpy(str, old, olen); /* Copy original content */
}
else { /* It's already a heap-allocated string */
str = (char*)p->u.str;