Skip to content

Commit c52faeb

Browse files
committed
Don't assign the result of mrb_funcall() directly to regs
There are two reasons: - If the mruby call stack is extended, the `ci` variable may become invalid. - The C language does not specify the order in which the left-hand and right-hand sides of an assignment expression are evaluated. Therefore, if the mruby data stack is extended, `ci->stack` may become invalid.
1 parent f61ab96 commit c52faeb

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

src/vm.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3112,7 +3112,9 @@ mrb_vm_exec(mrb_state *mrb, const struct RProc *begin_proc, const mrb_code *iseq
31123112
{ \
31133113
mrb_value arg = mrb_int_value(mrb, c); \
31143114
mrb_sym mid = MRB_OPSYM(op_name); \
3115-
regs[a] = mrb_funcall_argv(mrb, regs[a], mid, 1, &arg); \
3115+
mrb_value v = mrb_funcall_argv(mrb, regs[a], mid, 1, &arg); \
3116+
ci = mrb->c->ci; \
3117+
regs[a] = v; \
31163118
mrb_gc_arena_restore(mrb, ai); \
31173119
} \
31183120
break; \

0 commit comments

Comments
 (0)