1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix benign off-by-one

Browse Source 
Previously we always reserved one more byte than necessary in the
sprintf output string.
This commit is contained in:
John Hawthorn 2024-10-23 22:32:55 -07:00
parent 1f6dd9071c
commit c8c94bfb1e
Notes: git 2024-11-09 01:39:37 +00:00 
Merged: https://github.com/ruby/ruby/pull/12029
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sprintf.c
View File

@ -67,7 +67,8 @@ sign_bits(int base, const char *p)
#define CHECK(l) do {\ #define CHECK(l) do {\
int cr = ENC_CODERANGE(result);\ int cr = ENC_CODERANGE(result);\
while ((l) >= bsiz - blen) {\ RUBY_ASSERT(bsiz >= blen); \
while ((l) > bsiz - blen) {\
bsiz*=2;\ bsiz*=2;\
if (bsiz<0) rb_raise(rb_eArgError, "too big specifier");\ if (bsiz<0) rb_raise(rb_eArgError, "too big specifier");\
}\ }\