From c46f9e079364fdc959abfbb379651d6fc5867044 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Thu, 8 Jan 2026 12:13:08 +0900 Subject: [PATCH] mruby-compiler: fix uninitialized memory in realloc_pool_str() when converting a shared/static string (IREP_TT_SSTR) to heap-allocated (IREP_TT_STR), copy the original content to the new buffer. previously, the original content was lost when allocating new memory, leaving the first bytes uninitialized. this caused find_pool_str() to read uninitialized memory via memcmp() when searching for duplicate strings. reported by OSS-Fuzz. Co-authored-by: Claude --- mrbgems/mruby-compiler/core/codegen.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c index bddf40c4e..1e45a0f25 100644 --- a/mrbgems/mruby-compiler/core/codegen.c +++ b/mrbgems/mruby-compiler/core/codegen.c @@ -1242,8 +1242,11 @@ static void realloc_pool_str(codegen_scope *s, mrb_irep_pool *p, mrb_int len) { char *str; + mrb_int olen = p->tt >> 2; /* original length */ if ((p->tt & 3) == IREP_TT_SSTR) { /* Check if it's a shared/static string */ + const char *old = p->u.str; str = (char*)mrbc_malloc(len+1); /* Allocate new memory if it was shared */ + memcpy(str, old, olen); /* Copy original content */ } else { /* It's already a heap-allocated string */ str = (char*)p->u.str;