1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

string.c: integer overflow

Browse Source 
* string.c (rb_str_modify_expand): check integer overflow.
  [ruby-core:75592] [Bug #12390]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55054 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2016-05-18 05:52:40 +00:00
parent b8fde96861
commit b493d156de
3 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
Wed May 18 14:52:38 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
* string.c (rb_str_modify_expand): check integer overflow.
[ruby-core:75592] [Bug #12390]
Wed May 18 13:11:44 2016 NARUSE, Yui <naruse@ruby-lang.org> Wed May 18 13:11:44 2016 NARUSE, Yui <naruse@ruby-lang.org>
* re.c (match_ary_subseq): get subseq of match array without creating * re.c (match_ary_subseq): get subseq of match array without creating

3
string.c
View File

@ -1914,6 +1914,9 @@ rb_str_modify_expand(VALUE str, long expand)
else if (expand > 0) { else if (expand > 0) {
long len = RSTRING_LEN(str); long len = RSTRING_LEN(str);
long capa = len + expand; long capa = len + expand;
if (expand >= LONG_MAX - len - termlen) {
rb_raise(rb_eArgError, "string size too big");
}
if (!STR_EMBED_P(str)) { if (!STR_EMBED_P(str)) {
REALLOC_N(RSTRING(str)->as.heap.ptr, char, capa + termlen); REALLOC_N(RSTRING(str)->as.heap.ptr, char, capa + termlen);
RSTRING(str)->as.heap.aux.capa = capa; RSTRING(str)->as.heap.aux.capa = capa;

9
test/-ext-/string/test_modify_expand.rb
View File

@ -13,4 +13,13 @@ class Test_StringModifyExpand < Test::Unit::TestCase
s.replace("") s.replace("")
CMD CMD
end end
def test_integer_overflow
bug12390 = '[ruby-core:75592] [Bug #12390]'
s = Bug::String.new
long_max = (1 << (8 * RbConfig::SIZEOF['long'] - 1)) - 1
assert_raise(ArgumentError, bug12390) {
s.modify_expand!(long_max)
}
end
end end