fix: crash due to VarStack exceeding its capacity

yara-x/src/compiler/ir/ast2ir.rs

@@ -818,8 +818,10 @@ fn for_in_expr_from_ast(
     }
 
     // Create stack frame with capacity for the loop variables, plus 4
-    // temporary variables used for controlling the loop.
-    let mut stack_frame = ctx.vars.new_frame(loop_vars.len() as i32 + 4);
+    // temporary variables used for controlling the loop (see emit_for),
+    // plus one additional variable used in loops over arrays and maps
+    // (see emit_for_in_array and emit_for_in_map).
+    let mut stack_frame = ctx.vars.new_frame(loop_vars.len() as i32 + 5);
     let mut symbols = SymbolTable::new();
     let mut variables = Vec::new();
 

yara-x/src/modules/test_proto2/tests/mod.rs

@@ -155,6 +155,18 @@ fn test_proto2_module() {
           )"#
     );
 
+    condition_true!(
+        r#"for 1 s in test_proto2.array_struct : (
+            s.nested_int32_zero == 0
+          )"#
+    );
+
+    condition_false!(
+        r#"for 2 s in test_proto2.array_struct : (
+            s.nested_int32_zero == 0
+          )"#
+    );
+
     condition_true!(
         r#"for any s in test_proto2.array_struct : (
             s.nested_int32_zero == 0 and
@@ -174,6 +186,12 @@ fn test_proto2_module() {
           )"#
     );
 
+    condition_true!(
+        r#"for 1 key, value in test_proto2.map_int64_int64 : (
+                key == 100 and value == 1000
+          )"#
+    );
+
     condition_true!(
         r#"for any key, value in test_proto2.map_int64_string : (
                 key == 100 and value == "one thousand"