archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-15 13:39:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Handle mutation of array being merged into set

Browse source 
Check length of array during every iteration, as a #hash method
could truncate the array, resulting in heap-use-after-free.

Fixes [Bug #21305]
This commit is contained in:
Jeremy Evans 2025-05-03 11:07:22 -07:00
parent f3246ccebb
commit be665cf855
Notes: git 2025-05-03 19:11:32 +00:00
2 changed files with 15 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

12
set.c
View file

@ -1120,14 +1120,10 @@ set_merge_enum_into(VALUE set, VALUE arg)
set_iter(arg, set_merge_i, (st_data_t)&args);
}
else if (RB_TYPE_P(arg, T_ARRAY)) {
long len = RARRAY_LEN(arg);
if (RARRAY_LEN(arg) != 0) {
set_table *into = RSET_TABLE(set);
RARRAY_PTR_USE(arg, ptr, {
for(; len > 0; len--, ptr++) {
set_table_insert_wb(into, set, *ptr, NULL);
}
});
long i;
set_table *into = RSET_TABLE(set);
for (i=0; i<RARRAY_LEN(arg); i++) {
set_table_insert_wb(into, set, RARRAY_AREF(arg, i), NULL);
}
}
else {