Skip to content

Commit

Permalink
Use temporary variable to avoid potential crash; fix #3387
Browse files Browse the repository at this point in the history
This issue was original reported by https://hackerone.com/icanthack
https://hackerone.com/titanous suggested the solution.
`regs` may be reallocated in the function call.
  • Loading branch information
matz committed Jan 11, 2017
1 parent e1ff710 commit db1bd07
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/vm.c
Original file line number Diff line number Diff line change
Expand Up @@ -2411,7 +2411,8 @@ mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)
CASE(OP_RANGE) {
/* A B C R(A) := range_new(R(B),R(B+1),C) */
int b = GETARG_B(i);
regs[GETARG_A(i)] = mrb_range_new(mrb, regs[b], regs[b+1], GETARG_C(i));
mrb_value val = mrb_range_new(mrb, regs[b], regs[b+1], GETARG_C(i));
regs[GETARG_A(i)] = val;
ARENA_RESTORE(mrb, ai);
NEXT;
}
Expand Down

0 comments on commit db1bd07

Please sign in to comment.