diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-01-23 16:53:31 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-01-23 16:53:31 +0900 |
| commit | f0f095bc135c4d2e6f6d54d6b5683db77708369b (patch) | |
| tree | 81e516765575e393b476c0ae76c6a60ecd698e46 /src/state.c | |
| parent | 3ce82603a56f2b9480e2bd889dd98f813b868757 (diff) | |
| download | mruby-f0f095bc135c4d2e6f6d54d6b5683db77708369b.tar.gz mruby-f0f095bc135c4d2e6f6d54d6b5683db77708369b.zip | |
Fix a double free problem in codegen.c; fix #3378
This issue was first reported by https://hackerone.com/geeknik
The fix was proposed by @titanous
Diffstat (limited to 'src/state.c')
| -rw-r--r-- | src/state.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/state.c b/src/state.c index 1259ac3a0..11b71dd63 100644 --- a/src/state.c +++ b/src/state.c @@ -159,7 +159,9 @@ mrb_irep_free(mrb_state *mrb, mrb_irep *irep) } mrb_free(mrb, irep->reps); mrb_free(mrb, irep->lv); - mrb_free(mrb, (void *)irep->filename); + if (irep->own_filename) { + mrb_free(mrb, (void *)irep->filename); + } mrb_free(mrb, irep->lines); mrb_debug_info_free(mrb, irep->debug_info); mrb_free(mrb, irep); @@ -261,6 +263,7 @@ mrb_add_irep(mrb_state *mrb) irep = (mrb_irep *)mrb_malloc(mrb, sizeof(mrb_irep)); *irep = mrb_irep_zero; irep->refcnt = 1; + irep->own_filename = FALSE; return irep; } |