Summary of Changes

Hello @dearblue, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

I've addressed a critical heap buffer overflow within the method_missing implementation. The issue stemmed from an incorrect array index access when handling arguments, specifically when ci->n reached CALL_MAXARGS, leading to potential out-of-bounds memory reads. My change introduces a conditional check to ensure that argv[1] is only assigned argv[ci->n] when ci->n is not CALL_MAXARGS, thereby preventing the overflow and enhancing the stability of the system.

Highlights

• Heap Buffer Overflow Fix: I've implemented a fix for a heap buffer overflow that occurred within the method_missing implementation. Previously, when ci->n was equal to CALL_MAXARGS, the code would incorrectly assign argv[1] = argv[ci->n], potentially accessing memory outside the allocated range.
• Conditional Assignment: The core of the fix involves adding a conditional check if (ci->n != CALL_MAXARGS) around the assignment argv[1] = argv[ci->n] in src/vm.c. This ensures that the assignment only happens when ci->n is not CALL_MAXARGS, preventing the out-of-bounds read.

Code Review

This pull request addresses a critical heap buffer overflow vulnerability within the prepare_missing function. The issue occurred when handling method calls with keyword arguments where the number of positional arguments (ci->n) was equal to CALL_MAXARGS. In this scenario, the code attempted to access an out-of-bounds element of the argv array. The fix introduces a conditional check to prevent this memory access when ci->n == CALL_MAXARGS, correctly leaving the keyword arguments hash, which is already in the proper stack position, untouched. The change is precise and effectively resolves the security issue.