Check length of env stack before accessing upvar; fix #3995

1 files changed, 3 insertions, 3 deletions

diff --git a/src/vm.c b/src/vm.c
index ae9bf2e69..0acdd1ba8 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -1201,11 +1201,11 @@ RETRY_TRY_BLOCK:
       mrb_value *regs_a = regs + a;
       struct REnv *e = uvenv(mrb, c);
 
-      if (!e) {
-        *regs_a = mrb_nil_value();
+      if (e && b < MRB_ENV_STACK_LEN(e)) {
+        *regs_a = e->stack[b];
       }
       else {
-        *regs_a = e->stack[b];
+        *regs_a = mrb_nil_value();
       }
       NEXT;
     }