mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
mruby-compiler: fix uninitialized memory in realloc_pool_str()
when converting a shared/static string (IREP_TT_SSTR) to heap-allocated (IREP_TT_STR), copy the original content to the new buffer. previously, the original content was lost when allocating new memory, leaving the first bytes uninitialized. this caused find_pool_str() to read uninitialized memory via memcmp() when searching for duplicate strings. reported by OSS-Fuzz. Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -1242,8 +1242,11 @@ static void
|
||||
realloc_pool_str(codegen_scope *s, mrb_irep_pool *p, mrb_int len)
|
||||
{
|
||||
char *str;
|
||||
mrb_int olen = p->tt >> 2; /* original length */
|
||||
if ((p->tt & 3) == IREP_TT_SSTR) { /* Check if it's a shared/static string */
|
||||
const char *old = p->u.str;
|
||||
str = (char*)mrbc_malloc(len+1); /* Allocate new memory if it was shared */
|
||||
memcpy(str, old, olen); /* Copy original content */
|
||||
}
|
||||
else { /* It's already a heap-allocated string */
|
||||
str = (char*)p->u.str;
|
||||
|
||||
Reference in New Issue
Block a user