types: gracefully handle unpatched upvalues in ucv_free()

When a module function with unpatched upvalues is freed, ucv_free() might
access a NULL pointer through ucv_put_value(), so make sure to skip those
unset upvalue slots when freeing a closure.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

1 files changed, 2 insertions, 1 deletions

diff --git a/types.c b/types.c
index e05d685..5274d23 100644
--- a/types.c
+++ b/types.c
@@ -266,7 +266,8 @@ ucv_free(uc_value_t *uv, bool retain)
 		ref = &closure->ref;
 
 		for (i = 0; i < function->nupvals; i++)
-			ucv_put_value(&closure->upvals[i]->header, retain);
+			if (closure->upvals[i])
+				ucv_put_value(&closure->upvals[i]->header, retain);
 
 		ucv_put_value(&function->program->header, retain);
 		break;