Check if OP_RETURN cross C function boundary; fix #3462

mruby · Feb 27, 2017 · b563bcb7ff87b859ccdfa30f5d7c3f06cb26a239 · b563bcb
1 parent 50bbdbb
commit b563bcb7ff87b859ccdfa30f5d7c3f06cb26a239
Unified Split

Showing with 11 additions and 3 deletions.

+11 −3 src/vm.c
diff --git a/src/vm.c b/src/vm.c
@@ -1669,18 +1669,26 @@ mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)
          /* Fall through to OP_R_NORMAL otherwise */
          if (ci->acc >=0 && proc->env && !MRB_PROC_STRICT_P(proc)) {
            struct REnv *e = top_env(mrb, proc);
+            mrb_callinfo *ce;

            if (!MRB_ENV_STACK_SHARED_P(e)) {
              localjump_error(mrb, LOCALJUMP_ERROR_RETURN);
              goto L_RAISE;
            }
-            ci = mrb->c->cibase + e->cioff;
-            if (ci == mrb->c->cibase) {
+            
+            ce = mrb->c->cibase + e->cioff;
+            while (--ci > ce) {
+              if (ci->acc < 0) {
+                localjump_error(mrb, LOCALJUMP_ERROR_RETURN);
+                goto L_RAISE;
+              }
+            }
+            if (ce == mrb->c->cibase) {
              localjump_error(mrb, LOCALJUMP_ERROR_RETURN);
              goto L_RAISE;
            }
            mrb->c->stack = mrb->c->ci->stackent;
-            mrb->c->ci = ci;
+            mrb->c->ci = ce;
            break;
          }
        case OP_R_NORMAL: