Fix stack move segfaulting in OP_ARYCAT

Reported by https://hackerone.com/haquaman Testcase (couldn't get it to work as a test): def nil.b b *nil end nil.b
mruby · Dec 1, 2016 · 7d07466 · 7d07466
1 parent 2cca9d3
commit 7d07466
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/vm.c b/src/vm.c
@@ -2134,8 +2134,8 @@ mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)
 
     CASE(OP_ARYCAT) {
       /* A B            mrb_ary_concat(R(A),R(B)) */
-      mrb_ary_concat(mrb, regs[GETARG_A(i)],
-                     mrb_ary_splat(mrb, regs[GETARG_B(i)]));
+      mrb_value splat = mrb_ary_splat(mrb, regs[GETARG_B(i)]);
+      mrb_ary_concat(mrb, regs[GETARG_A(i)], splat);
       ARENA_RESTORE(mrb, ai);
       NEXT;
     }