1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* array.c (rb_ary_combination): fixed memory corruption due to too

Browse Source 
small memory allocation

* array.c (rb_ary_product): accessing out of memory bounds.
  condition fixed.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@13682 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
matz 2007-10-12 14:34:37 +00:00
parent b1e97c9070
commit 7927f32a19
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -6,6 +6,14 @@ Fri Oct 12 15:04:54 2007 Nobuyoshi Nakada <nobu@ruby-lang.org>
* trunk/parse.y (parser_yylex): ditto. * trunk/parse.y (parser_yylex): ditto.
Fri Oct 12 12:44:11 2007 Yukihiro Matsumoto <matz@ruby-lang.org>
* array.c (rb_ary_combination): fixed memory corruption due to too
small memory allocation
* array.c (rb_ary_product): accessing out of memory bounds.
condition fixed.
Thu Oct 11 21:10:17 2007 Yukihiro Matsumoto <matz@ruby-lang.org> Thu Oct 11 21:10:17 2007 Yukihiro Matsumoto <matz@ruby-lang.org>
* include/ruby/node.h (NOEX_LOCAL): remove unused local visibility. * include/ruby/node.h (NOEX_LOCAL): remove unused local visibility.

4
array.c
View File

@ -3112,7 +3112,7 @@ rb_ary_combination(VALUE ary, VALUE num)
} }
} }
else { else {
volatile VALUE t0 = tmpbuf(n, sizeof(long)); volatile VALUE t0 = tmpbuf(n+1, sizeof(long));
long *stack = (long*)RSTRING_PTR(t0); long *stack = (long*)RSTRING_PTR(t0);
long nlen = combi_len(len, n); long nlen = combi_len(len, n);
volatile VALUE cc = rb_ary_new2(n); volatile VALUE cc = rb_ary_new2(n);
@ -3199,7 +3199,7 @@ rb_ary_product(int argc, VALUE *argv, VALUE ary)
*/ */
m = n-1; m = n-1;
counters[m]++; counters[m]++;
while (m >= 0 && counters[m] == RARRAY_LEN(arrays[m])) { while (m > 0 && counters[m] == RARRAY_LEN(arrays[m])) {
counters[m] = 0; counters[m] = 0;
m--; m--;
counters[m]++; counters[m]++;