Fix a double free problem in codegen.c; fix #3378

This issue was first reported by https://hackerone.com/geeknik
The fix was proposed by @titanous
parent 3ce82603
...@@ -39,6 +39,7 @@ typedef struct mrb_irep { ...@@ -39,6 +39,7 @@ typedef struct mrb_irep {
struct mrb_locals *lv; struct mrb_locals *lv;
/* debug info */ /* debug info */
mrb_bool own_filename;
const char *filename; const char *filename;
uint16_t *lines; uint16_t *lines;
struct mrb_irep_debug_info* debug_info; struct mrb_irep_debug_info* debug_info;
......
...@@ -2844,6 +2844,7 @@ scope_finish(codegen_scope *s) ...@@ -2844,6 +2844,7 @@ scope_finish(codegen_scope *s)
memcpy(fname, s->filename, fname_len); memcpy(fname, s->filename, fname_len);
fname[fname_len] = '\0'; fname[fname_len] = '\0';
irep->filename = fname; irep->filename = fname;
irep->own_filename = TRUE;
} }
irep->nlocals = s->nlocals; irep->nlocals = s->nlocals;
...@@ -2951,9 +2952,6 @@ mrb_generate_code(mrb_state *mrb, parser_state *p) ...@@ -2951,9 +2952,6 @@ mrb_generate_code(mrb_state *mrb, parser_state *p)
return proc; return proc;
} }
MRB_CATCH(&scope->jmp) { MRB_CATCH(&scope->jmp) {
if (scope->filename == scope->irep->filename) {
scope->irep->filename = NULL;
}
mrb_irep_decref(mrb, scope->irep); mrb_irep_decref(mrb, scope->irep);
mrb_pool_close(scope->mpool); mrb_pool_close(scope->mpool);
return NULL; return NULL;
......
...@@ -159,7 +159,9 @@ mrb_irep_free(mrb_state *mrb, mrb_irep *irep) ...@@ -159,7 +159,9 @@ mrb_irep_free(mrb_state *mrb, mrb_irep *irep)
} }
mrb_free(mrb, irep->reps); mrb_free(mrb, irep->reps);
mrb_free(mrb, irep->lv); mrb_free(mrb, irep->lv);
if (irep->own_filename) {
mrb_free(mrb, (void *)irep->filename); mrb_free(mrb, (void *)irep->filename);
}
mrb_free(mrb, irep->lines); mrb_free(mrb, irep->lines);
mrb_debug_info_free(mrb, irep->debug_info); mrb_debug_info_free(mrb, irep->debug_info);
mrb_free(mrb, irep); mrb_free(mrb, irep);
...@@ -261,6 +263,7 @@ mrb_add_irep(mrb_state *mrb) ...@@ -261,6 +263,7 @@ mrb_add_irep(mrb_state *mrb)
irep = (mrb_irep *)mrb_malloc(mrb, sizeof(mrb_irep)); irep = (mrb_irep *)mrb_malloc(mrb, sizeof(mrb_irep));
*irep = mrb_irep_zero; *irep = mrb_irep_zero;
irep->refcnt = 1; irep->refcnt = 1;
irep->own_filename = FALSE;
return irep; return irep;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment