diff options
| author | Bouke van der Bijl <[email protected]> | 2016-11-17 11:12:35 -0500 |
|---|---|---|
| committer | Bouke van der Bijl <[email protected]> | 2016-11-24 10:09:37 -0500 |
| commit | 75b31d743813dd078c5b5c2ee5115b07b0c14f32 (patch) | |
| tree | 8eb7136e5f60090b3b680e515ebde2774a504f9c /mrbgems/mruby-compiler/core | |
| parent | a630c4f413f6af764e68210430e8b61a435d38d7 (diff) | |
| download | mruby-75b31d743813dd078c5b5c2ee5115b07b0c14f32.tar.gz mruby-75b31d743813dd078c5b5c2ee5115b07b0c14f32.zip | |
Fix segfault on method call with exactly 127 arguments
Reported by https://hackerone.com/dkasak
Diffstat (limited to 'mrbgems/mruby-compiler/core')
| -rw-r--r-- | mrbgems/mruby-compiler/core/codegen.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c index 0c84dd558..a36984dea 100644 --- a/mrbgems/mruby-compiler/core/codegen.c +++ b/mrbgems/mruby-compiler/core/codegen.c @@ -772,6 +772,8 @@ attrsym(codegen_scope *s, mrb_sym a) return mrb_intern(s->mrb, name2, len+1); } +#define CALL_MAXARGS 127 + static int gen_values(codegen_scope *s, node *t, int val) { @@ -780,7 +782,9 @@ gen_values(codegen_scope *s, node *t, int val) while (t) { is_splat = (intptr_t)t->car->car == NODE_SPLAT; /* splat mode */ - if (n >= 127 || is_splat) { + if ( + n >= CALL_MAXARGS - 1 /* need to subtract one because vm.c expects an array if n == CALL_MAXARGS */ + || is_splat) { if (val) { if (is_splat && n == 0 && (intptr_t)t->car->cdr->car == NODE_ARRAY) { codegen(s, t->car->cdr, VAL); @@ -831,8 +835,6 @@ gen_values(codegen_scope *s, node *t, int val) return n; } -#define CALL_MAXARGS 127 - static void gen_call(codegen_scope *s, node *tree, mrb_sym name, int sp, int val, int safe) { |