Commit 550d10a

committed

Fixed heap buffer overflow in #method_missing

When `ci->n == CALL_MAXARGS`, the correct value is `argv[1] = argv[1]`. However, it was always `args[1] = args[ci->n]`, which caused objects outside the range to be picked up. fixed #6584

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -697,7 +697,9 @@ prepare_missing(mrb_state mrb, mrb_callinfo ci, mrb_value recv, mrb_sym mid, m`
`697`	`697`	`}`
`698`	`698`	`else {`
`699`	`699`	`mrb_assert(ci->nk == 15);`
`700`		`-argv[1] = argv[ci->n];`
	`700`	`+if (ci->n != CALL_MAXARGS) {`
	`701`	`+argv[1] = argv[ci->n]; /* keyword arguments */`
	`702`	`+ }`
`701`	`703`	`argv[2] = blk;`
`702`	`704`	`}`
`703`	`705`	`argv[0] = args; /* must be replaced after saving argv[0] as it may be a keyword argument */`

0 commit comments

Comments

(0)