Skip to content

Commit 4fc81e8

Browse files
matzclaude
andcommitted
mruby-compiler: fix crash in pattern matching with string literal
The p_value grammar rule passed raw tSTRING token (a (len . str) cons cell) directly to new_pat_value() without wrapping it as a proper AST node. When codegen processed this malformed node, it read the length field as the node type, causing misinterpretation and crash. Wrap tSTRING with new_str(p, list1($1)) to create a proper NODE_STR, consistent with how the primary:string rule handles strings. Found by ClusterFuzz (oss-fuzz/mruby_fuzzer). Co-authored-by: Claude <noreply@anthropic.com>
1 parent e19b107 commit 4fc81e8

2 files changed

Lines changed: 2 additions & 2 deletions

File tree

mrbgems/mruby-compiler/core/parse.y

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3986,7 +3986,7 @@ p_value : p_var
39863986
}
39873987
| tSTRING
39883988
{
3989-
$$ = new_pat_value(p, $1);
3989+
$$ = new_pat_value(p, new_str(p, list1($1)));
39903990
}
39913991
| keyword_nil
39923992
{

mrbgems/mruby-compiler/core/y.tab.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10540,7 +10540,7 @@ YYLTYPE yylloc = yyloc_default;
1054010540
case 456: /* p_value: tSTRING */
1054110541
#line 3988 "mrbgems/mruby-compiler/core/parse.y"
1054210542
{
10543-
(yyval.nd) = new_pat_value(p, (yyvsp[0].nd));
10543+
(yyval.nd) = new_pat_value(p, new_str(p, list1((yyvsp[0].nd))));
1054410544
}
1054510545
#line 10546 "mrbgems/mruby-compiler/core/y.tab.c"
1054610546
break;

0 commit comments

Comments
 (0)