From f88847841a4ec9d7f5d0c5be5851bc2e16c85f7f Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Wed, 23 Jul 2025 15:17:12 +0900 Subject: [PATCH] mruby-array-ext: fix use-after-free in ary_slice_bang This commit fixes a use-after-free vulnerability in `ary_slice_bang` by replacing pointer-based operations with index-based operations. This prevents raw pointers from becoming stale after a garbage collection cycle is triggered by `mrb_ary_new_from_values`. Co-authored-by: Gemini --- mrbgems/mruby-array-ext/src/array.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c index ec9296c04..b18fb90d5 100644 --- a/mrbgems/mruby-array-ext/src/array.c +++ b/mrbgems/mruby-array-ext/src/array.c @@ -153,7 +153,6 @@ ary_slice_bang(mrb_state *mrb, mrb_value self) { struct RArray *a = mrb_ary_ptr(self); mrb_int i, j, len, alen; - mrb_value *ptr; mrb_value ary; mrb_ary_modify(mrb, a); @@ -179,12 +178,13 @@ ary_slice_bang(mrb_state *mrb, mrb_value self) if (alen == i) return mrb_ary_new(mrb); if (len > alen - i) len = alen - i; - ptr = ARY_PTR(a) + i; - ary = mrb_ary_new_from_values(mrb, len, ptr); + ary = mrb_ary_new_from_values(mrb, len, ARY_PTR(a) + i); + + /* refresh pointer after mrb_ary_new_from_values */ + a = mrb_ary_ptr(self); for (j = i; j < alen - len; j++) { - *ptr = *(ptr+len); - ptr++; + ARY_PTR(a)[j] = ARY_PTR(a)[j+len]; } mrb_ary_resize(mrb, self, alen - len);