Permalink
Browse files

Use temporary variable to avoid potential crash; fix #3387

This issue was original reported by https://hackerone.com/icanthack
https://hackerone.com/titanous suggested the solution.
`regs` may be reallocated in the function call.
  • Loading branch information...
matz committed Jan 11, 2017
1 parent e1ff710 commit db1bd078bedcc33bfd3ca4c45f46bc553786bfd8
Showing with 2 additions and 1 deletion.
  1. +2 −1 src/vm.c
View
@@ -2411,7 +2411,8 @@ mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)
CASE(OP_RANGE) {
/* A B C R(A) := range_new(R(B),R(B+1),C) */
int b = GETARG_B(i);
regs[GETARG_A(i)] = mrb_range_new(mrb, regs[b], regs[b+1], GETARG_C(i));
mrb_value val = mrb_range_new(mrb, regs[b], regs[b+1], GETARG_C(i));
regs[GETARG_A(i)] = val;
ARENA_RESTORE(mrb, ai);
NEXT;
}

0 comments on commit db1bd07

Please sign in to comment.