diff --git a/ChangeLog b/ChangeLog index 2ef06c2aba..2a564b23e0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +Thu Aug 5 19:59:55 2010 Nobuyoshi Nakada + + * string.c (rb_str_set_len): bail out when buffer overflowed + probably. + Thu Aug 5 19:51:21 2010 Nobuyoshi Nakada * compile.c (iseq_compile_each): drop unused ARGSCAT results. diff --git a/string.c b/string.c index cb371c2662..0aa2e6c52c 100644 --- a/string.c +++ b/string.c @@ -1693,10 +1693,15 @@ rb_str_unlocktmp(VALUE str) void rb_str_set_len(VALUE str, long len) { + long capa; + str_modifiable(str); if (STR_SHARED_P(str)) { rb_raise(rb_eRuntimeError, "can't set length of shared string"); } + if (len > (capa = (long)rb_str_capacity(str))) { + rb_bug("probable buffer overflow: %ld for %ld", len, capa); + } STR_SET_LEN(str, len); RSTRING_PTR(str)[len] = '\0'; }