Yukihiro "Matz" Matsumoto 9e93337479 mruby-regexp: copy named-capture names into owned arena ...

re_compile stored raw pointers into the pattern source in
pat->named_captures[i].name. Two ways this could dangle:

  - With /x, the source was c.stripped, freed at end of compile.
    Later reads (regexp construction, MatchData[:name] lookup) hit
    freed memory.

  - Without /x, the pointer aliased the input string's RSTRING_PTR.
    Mutating that string after Regexp.new could re-buffer it, leaving
    name dangling.

Allocate one arena buffer per regexp (only when num_named > 0) and
copy all names in. Common-case regexps without named captures pay
zero bytes.

Reported by OSS-Fuzz (testcase 5695283416858624).

Co-authored-by: Claude <noreply@anthropic.com>

2026-05-13 12:34:50 +09:00

..

re_internal.h

mruby-regexp: copy named-capture names into owned arena

2026-05-13 12:34:50 +09:00