From b7561dafb95b637911ddb6b667e7a24c18cc08d0 Mon Sep 17 00:00:00 2001 From: mame Date: Tue, 27 Nov 2018 07:34:21 +0000 Subject: [PATCH] compile.c: prevent out-of-bound initialization of coverage counters The coverage counters is initialized with `counter[lineno - 1] = 0`, but lineno may be 0, which led to write access for index -1. [ruby-core:90085] [Bug#15346] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@66025 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- compile.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/compile.c b/compile.c index 7d1ee0fadd..d87580af79 100644 --- a/compile.c +++ b/compile.c @@ -2027,7 +2027,9 @@ iseq_set_sequence(rb_iseq_t *iseq, LINK_ANCHOR *const anchor) if (ISEQ_LINE_COVERAGE(iseq) && (events & RUBY_EVENT_COVERAGE_LINE) && !(rb_get_coverage_mode() & COVERAGE_TARGET_ONESHOT_LINES)) { int line = iobj->insn_info.line_no; - RARRAY_ASET(ISEQ_LINE_COVERAGE(iseq), line - 1, INT2FIX(0)); + if (line >= 1) { + RARRAY_ASET(ISEQ_LINE_COVERAGE(iseq), line - 1, INT2FIX(0)); + } } if (ISEQ_BRANCH_COVERAGE(iseq) && (events & RUBY_EVENT_COVERAGE_BRANCH)) { while (RARRAY_LEN(ISEQ_PC2BRANCHINDEX(iseq)) <= code_index) {