Merge pull request #3991 from take-cheeze/fix_eval_env_gc

Fix possible heap use after free in `mrb_exec_irep` and stack expanding.

1 files changed, 12 insertions, 0 deletions

diff --git a/src/vm.c b/src/vm.c
index e5bbf657c..ae9bf2e69 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -156,6 +156,18 @@ envadjust(mrb_state *mrb, mrb_value *oldbase, mrb_value *newbase, size_t size)
 
       e->stack = newbase + off;
     }
+
+    if (ci->proc && MRB_PROC_ENV_P(ci->proc) && ci->env != MRB_PROC_ENV(ci->proc)) {
+      e = MRB_PROC_ENV(ci->proc);
+
+      if (e && MRB_ENV_STACK_SHARED_P(e) &&
+          (st = e->stack) && oldbase <= st && st < oldbase+size) {
+        ptrdiff_t off = e->stack - oldbase;
+
+        e->stack = newbase + off;
+      }
+    }
+
     ci->stackent = newbase + (ci->stackent - oldbase);
     ci++;
   }