1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* array.c (ary_new): new integer overflow check condition.

Browse Source 
suggested by TOYOFUKU Chikanobu <nobu_toyofuku at nifty.com> in
  [ruby-dev:34156].

* array.c (rb_ary_initialize): ditto.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@15997 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
matz 2008-04-14 03:58:35 +00:00
parent b2dde8243b
commit 6be7386218
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -6,6 +6,14 @@ Mon Apr 14 12:52:25 2008 Nobuyoshi Nakada <nobu@ruby-lang.org>
* gc.c (finalizers): removed. [ruby-dev:34349] * gc.c (finalizers): removed. [ruby-dev:34349]
Mon Apr 14 11:30:07 2008 Yukihiro Matsumoto <matz@ruby-lang.org>
* array.c (ary_new): new integer overflow check condition.
suggested by TOYOFUKU Chikanobu <nobu_toyofuku at nifty.com> in
[ruby-dev:34156].
* array.c (rb_ary_initialize): ditto.
Mon Apr 14 00:51:40 2008 Yusuke Endoh <mame@tsg.ne.jp> Mon Apr 14 00:51:40 2008 Yusuke Endoh <mame@tsg.ne.jp>
* test/ruby/test_parse.rb: add tests to achieve over 95% test coverage * test/ruby/test_parse.rb: add tests to achieve over 95% test coverage

4
array.c
View File

@ -114,7 +114,7 @@ ary_new(VALUE klass, long len)
if (len < 0) { if (len < 0) {
rb_raise(rb_eArgError, "negative array size (or size too big)"); rb_raise(rb_eArgError, "negative array size (or size too big)");
} }
if (len > 0 && len * (long)sizeof(VALUE) <= len) { if (len > LONG_MAX / sizeof(VALUE)) {
rb_raise(rb_eArgError, "array size too big"); rb_raise(rb_eArgError, "array size too big");
} }
ary = ary_alloc(klass); ary = ary_alloc(klass);
@ -313,7 +313,7 @@ rb_ary_initialize(int argc, VALUE *argv, VALUE ary)
if (len < 0) { if (len < 0) {
rb_raise(rb_eArgError, "negative array size"); rb_raise(rb_eArgError, "negative array size");
} }
if (len > 0 && len * (long)sizeof(VALUE) <= len) { if (len > LONG_MAX / sizeof(VALUE)) {
rb_raise(rb_eArgError, "array size too big"); rb_raise(rb_eArgError, "array size too big");
} }
rb_ary_modify(ary); rb_ary_modify(ary);