Skip to content
Permalink
Browse files
Use temporary variable to avoid potential crash; fix #3387
This issue was original reported by https://hackerone.com/icanthack
https://hackerone.com/titanous suggested the solution.
`regs` may be reallocated in the function call.
  • Loading branch information
matz committed Jan 11, 2017
1 parent e1ff710 commit db1bd078bedcc33bfd3ca4c45f46bc553786bfd8
Showing 1 changed file with 2 additions and 1 deletion.
@@ -2411,7 +2411,8 @@ mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)
CASE(OP_RANGE) {
/* A B C R(A) := range_new(R(B),R(B+1),C) */
int b = GETARG_B(i);
regs[GETARG_A(i)] = mrb_range_new(mrb, regs[b], regs[b+1], GETARG_C(i));
mrb_value val = mrb_range_new(mrb, regs[b], regs[b+1], GETARG_C(i));
regs[GETARG_A(i)] = val;
ARENA_RESTORE(mrb, ai);
NEXT;
}

0 comments on commit db1bd07

Please sign in to comment.