From 3b5497e32917f8dbc0f41a1eadd6edf63b45c1b8 Mon Sep 17 00:00:00 2001 From: dzaima Date: Thu, 22 May 2025 01:15:03 +0300 Subject: [PATCH] =?UTF-8?q?fix=20use-after-free=20in=20`a=E2=8C=BE(i?= =?UTF-8?q?=E2=8A=B8/)=F0=9D=95=A9`?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit not actually ever problematic I believe as `w` in *_ucw always happens to have other held references, but still a bug and could become problematic in the future; and the change is actually an improvement, bringing the SGetU computation out of paths that don't need it! --- src/builtins/slash.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/builtins/slash.c b/src/builtins/slash.c index 2e35a6ea..4ea5c118 100644 --- a/src/builtins/slash.c +++ b/src/builtins/slash.c @@ -1068,7 +1068,6 @@ B slash_ucw(B t, B o, B w, B x) { return def_fn_ucw(t, o, w, x); } usz ia = IA(x); - SGetU(w) u8 we = TI(w,elType); if (we != el_bit) { w = squeeze_numTry(w, &we); @@ -1188,7 +1187,7 @@ B slash_ucw(B t, B o, B w, B x) { mut_fillG(r, 0, m_f64(0), ia); NOGC_E; } - SGetU(rep) + SGetU(w) SGetU(rep) for (usz i = 0; i < ia; i++) { ux cw = o2u64G(GetU(w, i)); if (cw) {