From edb5b3672ba1261c0421b77f96d12062c771154b Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Wed, 14 Jun 2017 00:46:21 +0900
Subject: Avoid out-of-bound access of VM stack in OP_SENDB; fix #3692

---
 src/vm.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/vm.c b/src/vm.c
index 10ec5acdc..8968d4f65 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -1245,6 +1245,7 @@ RETRY_TRY_BLOCK:
       mrb_value recv, result;
       mrb_sym mid = syms[GETARG_B(i)];
       int bidx;
+      mrb_value blk;
 
       recv = regs[a];
       if (n == CALL_MAXARGS) {
@@ -1259,6 +1260,7 @@ RETRY_TRY_BLOCK:
           mrb->c->ci->nregs = bidx+1;
         }
         SET_NIL_VALUE(regs[bidx]);
+        SET_NIL_VALUE(blk);
       }
       else {
         mrb_value blk = regs[bidx];
@@ -1268,7 +1270,7 @@ RETRY_TRY_BLOCK:
             mrb->c->ci->nregs = bidx+1;
           }
           result = mrb_convert_type(mrb, blk, MRB_TT_PROC, "Proc", "to_proc");
-          regs[bidx] = result;
+          blk = regs[bidx] = result;
         }
       }
       c = mrb_class(mrb, recv);
@@ -1331,9 +1333,6 @@ RETRY_TRY_BLOCK:
         if (mrb->exc) goto L_RAISE;
         ci = mrb->c->ci;
         if (GET_OPCODE(i) == OP_SENDB) {
-          mrb_value blk;
-
-          blk = ci->stackent[bidx];
           if (mrb_type(blk) == MRB_TT_PROC) {
             struct RProc *p = mrb_proc_ptr(blk);
 
-- 
cgit v1.2.3