admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-array-ext: fix use-after-free in ary_slice_bang

Browse Source 
This commit fixes a use-after-free vulnerability in `ary_slice_bang` by
replacing pointer-based operations with index-based operations. This prevents
raw pointers from becoming stale after a garbage collection cycle is triggered
by `mrb_ary_new_from_values`.

Co-authored-by: Gemini <gemini@google.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-07-23 15:17:12 +09:00
parent 81726bacb8
commit f88847841a
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-array-ext/src/array.c
+5 -5
View File
@@ -153,7 +153,6 @@ ary_slice_bang(mrb_state *mrb, mrb_value self)
{
struct RArray *a = mrb_ary_ptr(self);
mrb_int i, j, len, alen;
mrb_value *ptr;
mrb_value ary;
mrb_ary_modify(mrb, a);
@@ -179,12 +178,13 @@ ary_slice_bang(mrb_state *mrb, mrb_value self)
if (alen == i) return mrb_ary_new(mrb);
if (len > alen - i) len = alen - i;
ptr = ARY_PTR(a) + i;
ary = mrb_ary_new_from_values(mrb, len, ptr);
ary = mrb_ary_new_from_values(mrb, len, ARY_PTR(a) + i);
/* refresh pointer after mrb_ary_new_from_values */
a = mrb_ary_ptr(self);
for (j = i; j < alen - len; j++) {
*ptr = *(ptr+len);
ptr++;
ARY_PTR(a)[j] = ARY_PTR(a)[j+len];
}
mrb_ary_resize(mrb, self, alen - len);