This commit fixes a use-after-free vulnerability in `ary_slice_bang` by
replacing pointer-based operations with index-based operations. This prevents
raw pointers from becoming stale after a garbage collection cycle is triggered
by `mrb_ary_new_from_values`.
Co-authored-by: Gemini <gemini@google.com>
This commit fixes a use-after-free vulnerability in `ary_uniq_bang` by
replacing pointer-based iteration with index-based loops. This prevents raw
pointers from becoming stale after a garbage collection cycle is triggered by
functions like `mrb_hash_set` or `mrb_equal`.
Co-authored-by: Gemini <gemini@google.com>
This commit fixes a use-after-free vulnerability in `ary_uniq` by replacing
pointer-based iteration with index-based loops. This prevents raw pointers from
becoming stale after a garbage collection cycle is triggered by functions like
`mrb_hash_set`, `mrb_ary_push`, or `mrb_equal`.
Co-authored-by: Gemini <gemini@google.com>
This commit fixes a use-after-free vulnerability in `ary_intersect_p` by
replacing pointer-based iteration with index-based loops. This prevents
raw pointers from becoming stale after a garbage collection cycle is
triggered by functions like `mrb_hash_set` or `mrb_equal`.
Co-authored-by: Gemini <gemini@google.com>
This commit fixes a use-after-free vulnerability in `ary_rotate` by replacing a
pointer-based loop with an index-based loop. This prevents a raw pointer from
becoming stale after a garbage collection cycle is triggered by `mrb_ary_push`.
Co-authored-by: Gemini <gemini@google.com>
This commit fixes a use-after-free vulnerability in `ary_compact` by replacing
a pointer-based loop with an index-based loop. This prevents a raw pointer from
becoming stale after a garbage collection cycle is triggered by `mrb_ary_push`.
Co-authored-by: Gemini <gemini@google.com>
This commit fixes a use-after-free vulnerability in
`ary_subtract_internal` by replacing pointer-based iteration
with index-based loops. This prevents raw pointers from becoming
stale after a garbage collection cycle is triggered by functions like
`mrb_hash_set` or `mrb_ary_push`.
This change also ensures that array-like objects are correctly converted
to arrays before being used in the subtraction logic.
Co-authored-by: Gemini <gemini@google.com>
Replace XML-style markup tags in comments with markdown equivalents:
- <code>...</code> to `...` (inline code)
- <tt>...</tt> to `...` (teletype/monospace)
- <i>...</i> to *...* (italics/emphasis)
- +...+ to `...` (parameter/variable references)
Updated 80+ files across core source, headers, mrbgems, and libraries
to use consistent markdown formatting in documentation comments.
Handled edge cases including special characters like <=> operators.
Co-authored-by: Atlassian Rovo Dev
This commit fixes a use-after-free vulnerability in `ary_intersection_internal`
by replacing pointer-based iteration with index-based loops. This prevents raw
pointers from becoming stale after a garbage collection cycle is triggered by
functions like `mrb_hash_set` or `mrb_ary_push`.
This change also ensures that array-like objects are correctly converted to
arrays before being used in the intersection logic.
Co-authored-by: Gemini <gemini@google.com>
Merged the separate "Array#-" and "Array#- with large arrays" test
blocks into a single comprehensive test. The unified test covers both
basic functionality (type checking, simple subtraction) and the
hash-based implementation for large arrays (>32 elements).
Co-authored-by: Atlassian Rovo Dev
Implement new method for Ruby 2.7+ pattern matching compatibility.
Returns the array itself to enable case/in pattern matching syntax.
Complements Hash#deconstruct_keys for complete pattern matching support.
Co-authored-by: Atlassian Rovo Dev
Moved Array#fetch from Ruby to C using hybrid implementation for
better performance. The C implementation handles all non-block cases
with unified API that eliminates Ruby conditional logic.
Key improvements:
- Fast C implementation for common cases (no blocks)
- Shared index normalization helper reusable for other methods
- Unified C call eliminates NONE sentinel comparison in Ruby
- Block cases use C helper for index normalization
Added comprehensive test coverage including edge cases, default values,
block handling, and error message format verification. Combined tests
to focus on functionality rather than implementation details.
Co-authored-by: Atlassian Rovo Dev
This commit also corrects the behavior of `Array#insert` when a negative
index is out of bounds. It now raises an `IndexError`, which is
consistent with CRuby.
Co-authored-by: Gemini <gemini@google.com>
This commit replaces the Ruby implementation of and with a C
implementation. The new implementation is iterative and uses a stack to
avoid deep recursion, which prevents stack overflows when flattening
deeply nested arrays.
Co-authored-by: Gemini <gemini@google.com>
Implemented shared C argument parser and separate fill logic to eliminate code
duplication while maximizing performance. The implementation uses C implemented
__fill_parse_args for unified argument handling and __fill_exec for fast
C-based value filling.
Added comprehensive test coverage for both shared argument parsing
and C fill implementation, including range arguments, block handling,
and array extension scenarios.
Co-authored-by: Atlassian Rovo Dev
Co-authored-by: Gemini <gemini@google.com>
The Ruby implementation of `Array#difference` was inefficient as it
called `Array#-` repeatedly, creating intermediate arrays.
This commit replaces it with a C implementation that processes all
arguments in a single pass. The core logic is extracted into a
shared helper function, `ary_subtract_internal`, which is now used
by both `Array#-` and `Array#difference`.
Co-authored-by: Gemini <gemini@google.com>
We have more chance to avoid hash allocation in set-like methods. Since
memory situation heavily depends on the platform, we may need to make
this threshold configurable in the future.
Co-authored-by: Atlassian Rovo Dev
Moved Array#intersect? implementation from Ruby to C to improve memory
usage and performance with early termination optimization. The C
implementation uses hash-based lookup for large arrays (>16 elements)
and linear search for smaller arrays.
Added comprehensive test coverage including early termination scenarios,
empty arrays, size optimization verification, and edge cases with
duplicates and large arrays.
Co-authored-by: Atlassian Rovo Dev
Moved Array#& (set intersection) implementation from Ruby to C to improve
memory usage and performance. The C implementation uses hash-based
deduplication for large arrays (>16 elements) and linear search for
smaller arrays, following the same hybrid pattern as Array#| and Array#-.
Key improvements:
- Hash-based approach uses mrb_hash_delete_key() for proper deduplication
- Linear search approach checks result array to ensure uniqueness
- Maintains order preservation from the first array
- Eliminates temporary object creation in Ruby implementation
Added comprehensive test coverage for both small and large array scenarios,
including edge cases like no intersection, complete intersection, and
duplicate handling.
Co-authored-by: Atlassian Rovo Dev
The C implementation uses hash-based deduplication for large arrays
(>16 elements) and linear search for smaller arrays, following the same
pattern as other set operations.
Co-authored-by: Atlassian Rovo Dev
Refactor Array#- to a C implementation for improved memory and performance,
especially for set operations. Uses a hybrid approach for efficiency.
Co-authored-by: Gemini <gemini@google.com>
The equal (`==`) method of the comparison target might be redefined
(the root cause of #6262), and not supposed to be compared with NONE.
To reduce chance for the problem, we use `NONE.equal?()` for comparison.
the worst case for `Array#reject!` (i.e. a proc always returning `true`)
is at least 5x worse than the worst case for `Array#select!` (proc
always returning `false`)
this commit unifies these implementations and inlines the (effective)
call of `#select!` in `#keep_if` and `#reject!` in `#delete_if`
Internal functions can only be called from within the library.
Functions listed in `mruby/internal.h` can be called from:
* core (src/*.c)
* gems (mrbgems/**/*.c)
But not from the application linked with `libmruby`.
ref. #5613
I checked with Valgrind, and the methods that can cause use-after-free are `Array#rotate`, `Array#rotate!`, and `String#byteslice`.
Since `String#rindex` uses `RSTRING_LEN()` indirectly inside the function, no reference to the out-of-bounds range is generated.
Yukihiro "Matz" Matsumoto