admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

array.c (sort_cmp): comparing objects may be freed by GC; #6326

Browse Source 
If comparing function (block or `<=>`) modifies the sorting array and GC
happens after the modification, objects passed to comparison may be
freed by GC.
This commit is contained in:
Yukihiro "Matz" Matsumoto
2024-08-23 22:29:45 +09:00
parent 58c70834d9
commit f35000f2a9
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/array.c
+3 -4
View File
@@ -1586,15 +1586,14 @@ static mrb_bool
sort_cmp(mrb_state *mrb, mrb_value ary, mrb_value *p, mrb_int a, mrb_int b, mrb_value blk)
{
mrb_int cmp;
mrb_value va = p[a], vb = p[b];
if (mrb_nil_p(blk)) {
cmp = mrb_cmp(mrb, va, vb);
cmp = mrb_cmp(mrb, p[a], p[b]);
}
else {
mrb_value c = mrb_funcall_id(mrb, blk, MRB_SYM(call), 2, va, vb);
mrb_value c = mrb_funcall_id(mrb, blk, MRB_SYM(call), 2, p[a], p[b]);
if (mrb_nil_p(c) || !mrb_fixnum_p(c)) {
mrb_raisef(mrb, E_ARGUMENT_ERROR, "comparison of %!v and %!v failed", va, vb);
mrb_raisef(mrb, E_ARGUMENT_ERROR, "comparison failed (element %d and %d)", a, b);
}
cmp = mrb_fixnum(c);
}