admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed too much value_copy() when block is not given; fix #3440

Browse Source 
The issue was reported by https://hackerone.com/titanous
This commit is contained in:
Yukihiro "Matz" Matsumoto
2017-02-13 18:18:09 +09:00
parent b23874777d
commit f198530444
1 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/vm.c
+12 -4
View File
@@ -1151,12 +1151,14 @@ RETRY_TRY_BLOCK:
}
if (GET_OPCODE(i) != OP_SENDB) {
SET_NIL_VALUE(regs[bidx]);
bidx = 0;
}
else {
mrb_value blk = regs[bidx];
if (!mrb_nil_p(blk) && mrb_type(blk) != MRB_TT_PROC) {
regs[bidx] = mrb_convert_type(mrb, blk, MRB_TT_PROC, "Proc", "to_proc");
}
bidx = 1;
}
c = mrb_class(mrb, recv);
m = mrb_method_search_vm(mrb, &c, mid);
@@ -1177,15 +1179,17 @@ RETRY_TRY_BLOCK:
mrb_method_missing(mrb, mid, recv, args);
}
mid = missing;
if (n == CALL_MAXARGS-1) {
regs[a+1] = mrb_ary_new_from_values(mrb, n, regs+a+1);
n++;
}
if (n == CALL_MAXARGS) {
mrb_ary_unshift(mrb, regs[a+1], sym);
}
else {
value_move(regs+a+2, regs+a+1, ++n);
value_move(regs+a+2, regs+a+1, n+bidx);
regs[a+1] = sym;
if (n == CALL_MAXARGS) {
regs[a+1] = mrb_ary_new_from_values(mrb, n, regs+a+1);
}
n++;
}
}
@@ -1355,6 +1359,10 @@ RETRY_TRY_BLOCK:
mrb_method_missing(mrb, mid, recv, args);
}
mid = missing;
if (n == CALL_MAXARGS-1) {
regs[a+1] = mrb_ary_new_from_values(mrb, n, regs+a+1);
n++;
}
if (n == CALL_MAXARGS) {
mrb_ary_unshift(mrb, regs[a+1], mrb_symbol_value(ci->mid));
}