# HG changeset patch # User Petter T. # Date 1687562390 -7200 # Sat Jun 24 01:19:50 2023 +0200 # Node ID 7b6c9c6bce7dae978cf96802459c9e2fd27e679c # Parent 0789ae11b09672966d6a20e1079d01feea76b235 VM: Prevent out-of-bounds read. Prefetching of 'arg0' for single byte opcodes leads to reading past the end of the array that stores the opcodes. * libinterp/parse-tree/pt-bytecode-walk.cc: Append dummy opcode diff -r 0789ae11b096 -r 7b6c9c6bce7d libinterp/parse-tree/pt-bytecode-walk.cc --- a/libinterp/parse-tree/pt-bytecode-walk.cc Fri Jun 16 00:18:48 2023 +0200 +++ b/libinterp/parse-tree/pt-bytecode-walk.cc Sat Jun 24 01:19:50 2023 +0200 @@ -2314,6 +2314,11 @@ // Set the amount of locals that has a placeholder since earlier SET_CODE_SHORT (m_offset_n_locals, m_n_locals); + // When the last byte of opcode, a 'RET', is to be executed the VM reads the next byte + // of code and puts it in 'arg0'. So we need to ad an dummy opcode afterwards + // to prevent out of bounds reads. + PUSH_CODE (INSTR::RET); + // We want to add the locals to the scope in slot order // so we push all the locals' names to a vector by their slot // number