1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* pack.c (encodes): make buff fixed length to avoid SEGV by

Browse Source 
ruby -e '["a"*10000000].pack("m1000000000")'


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@19139 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
akr 2008-09-04 15:06:34 +00:00
parent d44ee210fa
commit 40c771fd45
2 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
Fri Sep 5 00:05:27 2008 Tanaka Akira <akr@fsij.org>
* pack.c (encodes): make buff fixed length to avoid SEGV by
ruby -e '["a"*10000000].pack("m1000000000")'
Thu Sep 4 23:47:05 2008 Yusuke Endoh <mame@tsg.ne.jp> Thu Sep 4 23:47:05 2008 Yusuke Endoh <mame@tsg.ne.jp>
* ext/bigdecimal/bigdecimal.c (BigDecimal_mode): set exception mode * ext/bigdecimal/bigdecimal.c (BigDecimal_mode): set exception mode

21
pack.c
View File

@ -1009,7 +1009,7 @@ static const char b64_table[] =
static void static void
encodes(VALUE str, const char *s, long len, int type) encodes(VALUE str, const char *s, long len, int type)
{ {
char *buff = ALLOCA_N(char, len * 4 / 3 + 6); char buff[4096];
long i = 0; long i = 0;
const char *trans = type == 'u' ? uu_table : b64_table; const char *trans = type == 'u' ? uu_table : b64_table;
int padding; int padding;
@ -1022,13 +1022,20 @@ encodes(VALUE str, const char *s, long len, int type)
padding = '='; padding = '=';
} }
while (len >= 3) { while (len >= 3) {
buff[i++] = trans[077 & (*s >> 2)]; while (len >= 3 && sizeof(buff)-i >= 4) {
buff[i++] = trans[077 & (((*s << 4) & 060) | ((s[1] >> 4) & 017))]; buff[i++] = trans[077 & (*s >> 2)];
buff[i++] = trans[077 & (((s[1] << 2) & 074) | ((s[2] >> 6) & 03))]; buff[i++] = trans[077 & (((*s << 4) & 060) | ((s[1] >> 4) & 017))];
buff[i++] = trans[077 & s[2]]; buff[i++] = trans[077 & (((s[1] << 2) & 074) | ((s[2] >> 6) & 03))];
s += 3; buff[i++] = trans[077 & s[2]];
len -= 3; s += 3;
len -= 3;
}
if (sizeof(buff)-i < 4) {
rb_str_buf_cat(str, buff, i);
i = 0;
}
} }
if (len == 2) { if (len == 2) {
buff[i++] = trans[077 & (*s >> 2)]; buff[i++] = trans[077 & (*s >> 2)];
buff[i++] = trans[077 & (((*s << 4) & 060) | ((s[1] >> 4) & 017))]; buff[i++] = trans[077 & (((*s << 4) & 060) | ((s[1] >> 4) & 017))];