diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-02-28 09:13:51 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-02-28 09:14:42 +0900 |
| commit | bdac7dfae818908f7459fc086727b717aa586c7d (patch) | |
| tree | 7dbf5b9759783b958a60409edfbdc9537535ff88 /src/string.c | |
| parent | a76dc04aa832172495f48e0320e077906c6f7625 (diff) | |
| download | mruby-bdac7dfae818908f7459fc086727b717aa586c7d.tar.gz mruby-bdac7dfae818908f7459fc086727b717aa586c7d.zip | |
Check if the value is fixnum before mrb_funcall(); fix #3476
The issue is reported by https://hackerone.com/aerodudrizzt
Diffstat (limited to 'src/string.c')
| -rw-r--r-- | src/string.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/string.c b/src/string.c index acf32167d..b5d34b8b5 100644 --- a/src/string.c +++ b/src/string.c @@ -959,8 +959,8 @@ mrb_str_cmp_m(mrb_state *mrb, mrb_value str1) else { mrb_value tmp = mrb_funcall(mrb, str2, "<=>", 1, str1); - if (mrb_nil_p(tmp)) return mrb_nil_value(); - if (!mrb_fixnum(tmp)) { + if (!mrb_nil_p(tmp)) return mrb_nil_value(); + if (!mrb_fixnum_p(tmp)) { return mrb_funcall(mrb, mrb_fixnum_value(0), "-", 1, tmp); } result = -mrb_fixnum(tmp); |