Actions
Bug #15951
closedIssue with Array#rindex when rb_equal call modifies receiver
Description
Hi, this causes out of bounds RARRAY_AREF call in rb_ary_rindex
in trunk branch, and results in a segmentation fault on my system:
o = Object.new
def o.==(other)
other.replace([]) if Array === other
false
end
a = Array.new(10)
a.fill(o)
p a.rindex(a)
The fix is to check the array length after the call to rb_equal
and break out of the loop if the next iteration will result in an out of bounds read.
I'll add a PR for this.
Thanks,
Updated by luke-gru (Luke Gruber) about 5 years ago
Updated by luke-gru (Luke Gruber) about 5 years ago
- Status changed from Open to Closed
Applied in changeset git|c033dc3073839e3578f1ba25d53b837974b56474.
Fix issue with Array#rindex when rb_equal modifies receiver array
Fixes [Bug #15951]
Actions
Like0
Like0Like0