diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-08-05 01:18:52 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-08-05 01:18:52 +0900 |
| commit | 006661394d792e179575e79ae159d604c612950b (patch) | |
| tree | 7cc21e07763bd9bebed199817a17717d6d0d7a64 /src/array.c | |
| parent | 36dbfd9bda18c2dbafcf58b524b80f4318a3b677 (diff) | |
| download | mruby-006661394d792e179575e79ae159d604c612950b.tar.gz mruby-006661394d792e179575e79ae159d604c612950b.zip | |
Fixed heap buffer overflow in `mrb_ary_unshift_m`; fix #3760
Diffstat (limited to 'src/array.c')
| -rw-r--r-- | src/array.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/array.c b/src/array.c index 9124ff950..2ef29dcf5 100644 --- a/src/array.c +++ b/src/array.c @@ -584,8 +584,8 @@ mrb_ary_unshift_m(mrb_state *mrb, mrb_value self) } array_copy(ptr, vals, alen); ARY_SET_LEN(a, len+alen); - while (len--) { - mrb_field_write_barrier_value(mrb, (struct RBasic*)a, vals[len]); + while (alen--) { + mrb_field_write_barrier_value(mrb, (struct RBasic*)a, vals[alen]); } return self; |