Fix stack move segfaulting in OP_ARYCAT

Reported by https://hackerone.com/haquaman

Testcase (couldn't get it to work as a test):

def nil.b
  b *nil
end
nil.b
parent 2cca9d36
...@@ -2134,8 +2134,8 @@ RETRY_TRY_BLOCK: ...@@ -2134,8 +2134,8 @@ RETRY_TRY_BLOCK:
CASE(OP_ARYCAT) { CASE(OP_ARYCAT) {
/* A B mrb_ary_concat(R(A),R(B)) */ /* A B mrb_ary_concat(R(A),R(B)) */
mrb_ary_concat(mrb, regs[GETARG_A(i)], mrb_value splat = mrb_ary_splat(mrb, regs[GETARG_B(i)]);
mrb_ary_splat(mrb, regs[GETARG_B(i)])); mrb_ary_concat(mrb, regs[GETARG_A(i)], splat);
ARENA_RESTORE(mrb, ai); ARENA_RESTORE(mrb, ai);
NEXT; NEXT;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment