From 197b89620c4b498a39c9823ca4e992366562d71e Mon Sep 17 00:00:00 2001 From: kichikuou Date: Sun, 15 Mar 2026 08:00:20 +0900 Subject: [PATCH] Fix extra heap_unref for ref arguments in delegate calls When a delegate finishes calling all registered functions, variable_fini() was called on the original stack arguments. For ref types, this results in an unbalanced heap_unref() because the caller pushes raw ref-values without incrementing the reference count. Non-ref string/struct/array arguments are not affected because their push instructions allocate new heap slots with ownership. This fixes use-after-free in T_Loop@checkSelect in Rance 9. --- src/vm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/vm.c b/src/vm.c index daa7453..249f836 100644 --- a/src/vm.c +++ b/src/vm.c @@ -421,7 +421,15 @@ static void delegate_call(int dg_no, int return_address) stack_pop(); // dg_index stack_pop(); // dg_page for (int i = ain->delegates[dg_no].nr_variables - 1; i >= 0; i--) { - variable_fini(stack_pop(), ain->delegates[dg_no].variables[i].type.data, true); + union vm_value v = stack_pop(); + enum ain_data_type type = ain->delegates[dg_no].variables[i].type.data; + switch (type) { + case AIN_REF_TYPE: + break; + default: + variable_fini(v, type, true); + break; + } } if (return_values) { stack_push(r);