Files
mruby-mruby/mrbgems/mruby-compiler/core
Yukihiro "Matz" Matsumoto eea9e30979 mruby-compiler: fix heap-buffer-overflow in pattern alternation codegen
The JMPNOT-to-JMPIF optimization in NODE_PAT_ALT assumed the fail
chain always ends with OP_JMPNOT (format BS), but NODE_PAT_PIN
generates OP_JMP (format S) when the pinned variable is undefined.
Writing OP_JMPIF at left_fail-2 then corrupts the preceding
instruction's operand, causing out-of-bounds pool access at runtime.

Co-authored-by: Claude <noreply@anthropic.com>
2026-02-10 11:12:27 +09:00
..
2021-03-01 10:06:17 +10:00