mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
66f438d8fe
mrb_debug_set_break_method() freed set_class after mrdb_strdup() of method_name failed but did not return. Execution continued into alloc_breakpoint(), which on failure double-freed set_class, or on success stored the dangling pointer in the breakpoint table for later use-after-free. Return MRB_DEBUG_NOBUF immediately after the free. mrdb_strdup uses mrb_malloc_simple which returns NULL on OOM (it does not raise), so the NULL check is reachable in practice. close #6851 Co-authored-by: Claude <noreply@anthropic.com>