From d823045af43869171e17020ec995a878d31c5371 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Fri, 18 Feb 2022 14:38:07 +0900
Subject: [PATCH] vm.c: packed arguments length may be zero for `send` method.

Address CVE-2022-0631
---
 src/vm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/vm.c b/src/vm.c
index b0cd9428d..b696f89ba 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -689,9 +689,11 @@ mrb_f_send(mrb_state *mrb, mrb_value self)
   regs = mrb->c->ci->stack+1;
 
   if (n == 0) {
+  argnum_error:
     mrb_argnum_error(mrb, 0, 1, -1);
   }
   else if (n == 15) {
+    if (RARRAY_LEN(regs[0]) == 0) goto argnum_error;
     name = mrb_obj_to_sym(mrb, RARRAY_PTR(regs[0])[0]);
   }
   else {