From c779413df39ef7d96583bda08104491c55049fad Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Thu, 15 Oct 2020 18:32:27 +0900 Subject: Fix out of bound access in `parse.y`. --- mrbgems/mruby-compiler/core/parse.y | 2 +- mrbgems/mruby-compiler/core/y.tab.c | 2 +- src/load.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/mrbgems/mruby-compiler/core/parse.y b/mrbgems/mruby-compiler/core/parse.y index 3cd74971f..6409f0b3d 100644 --- a/mrbgems/mruby-compiler/core/parse.y +++ b/mrbgems/mruby-compiler/core/parse.y @@ -284,7 +284,7 @@ local_var_p(parser_state *p, mrb_sym sym) int i; if (!v) break; - for (i=0; i < ir->nlocals; i++) { + for (i=0; i+1 < ir->nlocals; i++) { if (v[i] == sym) return TRUE; } if (MRB_PROC_SCOPE_P(u)) break; diff --git a/mrbgems/mruby-compiler/core/y.tab.c b/mrbgems/mruby-compiler/core/y.tab.c index b28509d81..becf886c5 100644 --- a/mrbgems/mruby-compiler/core/y.tab.c +++ b/mrbgems/mruby-compiler/core/y.tab.c @@ -347,7 +347,7 @@ local_var_p(parser_state *p, mrb_sym sym) int i; if (!v) break; - for (i=0; i < ir->nlocals; i++) { + for (i=0; i+1 < ir->nlocals; i++) { if (v[i] == sym) return TRUE; } if (MRB_PROC_SCOPE_P(u)) break; diff --git a/src/load.c b/src/load.c index c1a8c4c87..262600685 100644 --- a/src/load.c +++ b/src/load.c @@ -434,7 +434,7 @@ read_lv_record(mrb_state *mrb, const uint8_t *start, mrb_irep *irep, size_t *rec irep->lv = lv = (mrb_sym*)mrb_malloc(mrb, sizeof(mrb_sym) * (irep->nlocals - 1)); - for (i = 0; i + 1< irep->nlocals; ++i) { + for (i = 0; i + 1 < irep->nlocals; ++i) { uint16_t const sym_idx = bin_to_uint16(bin); bin += sizeof(uint16_t); if (sym_idx == RITE_LV_NULL_MARK) { -- cgit v1.2.3