fcc5843
From f690eb34e28b000627e5f0649dd81a04e252286f Mon Sep 17 00:00:00 2001
fcc5843
From: Nobuyoshi Nakada <nobu@ruby-lang.org>
fcc5843
Date: Sat, 2 Jan 2021 12:11:52 +0900
fcc5843
Subject: [PATCH] Fixed dangling imemo_tmpbuf
fcc5843
fcc5843
The count of rb_alloc_tmp_buffer_with_count is the allocation size
fcc5843
counted in VALUE size but not in the requested element size.
fcc5843
fcc5843
Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
fcc5843
Co-authored-by: Koichi Sasada <ko1@atdot.net>
fcc5843
---
fcc5843
 include/ruby/internal/memory.h | 5 +++--
fcc5843
 1 file changed, 3 insertions(+), 2 deletions(-)
fcc5843
fcc5843
diff --git a/include/ruby/internal/memory.h b/include/ruby/internal/memory.h
fcc5843
index 974c21e19ce8..7d24df494512 100644
fcc5843
--- a/include/ruby/internal/memory.h
fcc5843
+++ b/include/ruby/internal/memory.h
fcc5843
@@ -250,8 +250,9 @@ rbimpl_size_mul_or_raise(size_t x, size_t y)
fcc5843
 static inline void *
fcc5843
 rb_alloc_tmp_buffer2(volatile VALUE *store, long count, size_t elsize)
fcc5843
 {
fcc5843
-    return rb_alloc_tmp_buffer_with_count(
fcc5843
-        store, rbimpl_size_mul_or_raise(count, elsize), count);
fcc5843
+    const size_t total_size = rbimpl_size_mul_or_raise(count, elsize);
fcc5843
+    const size_t cnt = (total_size + sizeof(VALUE) - 1) / sizeof(VALUE);
fcc5843
+    return rb_alloc_tmp_buffer_with_count(store, total_size, cnt);
fcc5843
 }
fcc5843
 
fcc5843
 #ifndef __MINGW32__