AI-generated code overwrote a compiler opcode at fail_pos-2 with OP_JMPIF, causing an out-of-bounds write and potential memory corruption.

@@ -6402,10 +6402,23 @@ codegen(codegen_scope *s, node *tree, int val)           genop_1(s, OP_LOADT, cursp());           push();         }-        match_pos = genjmp(s, OP_JMP, JMPLINK_START);++        /* Optimize: single JMPNOT can be inverted to JMPIF, eliminating JMP */+        /* Conditions: (1) single entry in fail_pos chain, and+         * (2) JMPNOT is immediately before current position (no code between) */+        if ((int32_t)(fail_pos + 2) + (int16_t)PEEK_S(s->iseq+fail_pos) == 0 &&+            fail_pos + 2 == s->pc) {+          /* Single failure point - invert JMPNOT to JMPIF */+          s->iseq[fail_pos - 2] = OP_JMPIF;+          match_pos = fail_pos;+        }+        else {+          /* Multiple failure points - need JMP to skip error handling */+          match_pos = genjmp(s, OP_JMP, JMPLINK_START);+          dispatch_linked(s, fail_pos);+        }

Show 5 hidden lines

         /* Pattern failed */-        dispatch_linked(s, fail_pos);         pop();  /* pop the value */         if (mp->raise_on_fail) {           /* expr => pattern: raise NoMatchingPatternError */

Adds a pattern-match optimization that rewrites the opcode at fail_pos minus two based only on position and jump-offset relationships, allowing an out-of-bounds write when that slot does not hold the expected failing opcode.

Security fix

Fixmrbgems/mruby-compiler/core/codegen.c source sysfce2/mruby@e50f15c1c6+5−3

@@ -6626,10 +6626,12 @@ codegen(codegen_scope *s, node *tree, int val)         }          /* Optimize: single JMPNOT can be inverted to JMPIF, eliminating JMP */-        /* Conditions: (1) single entry in fail_pos chain, and-         * (2) JMPNOT is immediately before current position (no code between) */+        /* Conditions: (1) single entry in fail_pos chain,+         * (2) JMPNOT is immediately before current position (no code between), and+         * (3) the instruction is actually JMPNOT (not JMP from undefined pinned var) */         if ((int32_t)(fail_pos + 2) + (int16_t)PEEK_S(s->iseq+fail_pos) == 0 &&-            fail_pos + 2 == s->pc) {+            fail_pos + 2 == s->pc &&+            s->iseq[fail_pos - 2] == OP_JMPNOT) {           /* Single failure point - invert JMPNOT to JMPIF */           s->iseq[fail_pos - 2] = OP_JMPIF;           match_pos = fail_pos;

Adds a third prerequisite requiring the instruction at fail_pos minus two to equal the original negative conditional before replacing it with the conditional forward branch, preventing a stale or unrelated opcode from being overwritten.

Patch fingerprints

AI-assisted change 649ba9b50f386aa9c60cc1c3f4db76b722d4bf971829deb6eebbfc6cac42abdf · Fix ea03002654674f589540573a9c336337103e03ffb85d911aa5ad2e6ea7e6232f

AI-assisted change

AI-assisted changemrbgems/mruby-compiler/core/codegen.c source sysfce2/mruby@2b72d8a7c1+15−2

@@ -6402,10 +6402,23 @@ codegen(codegen_scope *s, node *tree, int val)           genop_1(s, OP_LOADT, cursp());           push();         }-        match_pos = genjmp(s, OP_JMP, JMPLINK_START);++        /* Optimize: single JMPNOT can be inverted to JMPIF, eliminating JMP */+        /* Conditions: (1) single entry in fail_pos chain, and+         * (2) JMPNOT is immediately before current position (no code between) */+        if ((int32_t)(fail_pos + 2) + (int16_t)PEEK_S(s->iseq+fail_pos) == 0 &&+            fail_pos + 2 == s->pc) {+          /* Single failure point - invert JMPNOT to JMPIF */+          s->iseq[fail_pos - 2] = OP_JMPIF;+          match_pos = fail_pos;+        }+        else {+          /* Multiple failure points - need JMP to skip error handling */+          match_pos = genjmp(s, OP_JMP, JMPLINK_START);+          dispatch_linked(s, fail_pos);+        }

Show 5 hidden lines

         /* Pattern failed */-        dispatch_linked(s, fail_pos);         pop();  /* pop the value */         if (mp->raise_on_fail) {           /* expr => pattern: raise NoMatchingPatternError */

Security fix

Fixmrbgems/mruby-compiler/core/codegen.c source sysfce2/mruby@e50f15c1c6+5−3

@@ -6626,10 +6626,12 @@ codegen(codegen_scope *s, node *tree, int val)         }          /* Optimize: single JMPNOT can be inverted to JMPIF, eliminating JMP */-        /* Conditions: (1) single entry in fail_pos chain, and-         * (2) JMPNOT is immediately before current position (no code between) */+        /* Conditions: (1) single entry in fail_pos chain,+         * (2) JMPNOT is immediately before current position (no code between), and+         * (3) the instruction is actually JMPNOT (not JMP from undefined pinned var) */         if ((int32_t)(fail_pos + 2) + (int16_t)PEEK_S(s->iseq+fail_pos) == 0 &&-            fail_pos + 2 == s->pc) {+            fail_pos + 2 == s->pc &&+            s->iseq[fail_pos - 2] == OP_JMPNOT) {           /* Single failure point - invert JMPNOT to JMPIF */           s->iseq[fail_pos - 2] = OP_JMPIF;           match_pos = fail_pos;