1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

sprintf.c: overflow check

Browse Source 
* sprintf.c (ruby_do_vsnprintf): pathologically, get rid of
  negative value when the result length exceeds INT_MAX.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62328 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2018-02-09 03:15:20 +00:00
parent bf618557b1
commit d4d966f967
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sprintf.c
View File

@ -1275,7 +1275,7 @@ ruby_vsnprintf(char *str, size_t n, const char *fmt, va_list ap)
static int static int
ruby_do_vsnprintf(char *str, size_t n, const char *fmt, va_list ap) ruby_do_vsnprintf(char *str, size_t n, const char *fmt, va_list ap)
{ {
int ret; ssize_t ret;
rb_printf_buffer f; rb_printf_buffer f;
f._flags = __SWR | __SSTR; f._flags = __SWR | __SSTR;
@ -1283,9 +1283,12 @@ ruby_do_vsnprintf(char *str, size_t n, const char *fmt, va_list ap)
f._bf._size = f._w = str ? (n - 1) : 0; f._bf._size = f._w = str ? (n - 1) : 0;
f.vwrite = BSD__sfvwrite; f.vwrite = BSD__sfvwrite;
f.vextra = 0; f.vextra = 0;
ret = (int)BSD_vfprintf(&f, fmt, ap); ret = BSD_vfprintf(&f, fmt, ap);
if (str) *f._p = 0; if (str) *f._p = 0;
return ret; #if SIZEOF_SIZE_T > SIZEOF_INT
if (n > INT_MAX) return INT_MAX;
#endif
return (int)ret;
} }
int int