1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

stringio.c: fix index overflow

Browse Source 
* ext/stringio/stringio.c (strio_getline): fix pointer index
  overflow.  reported by Guido Vranken <guido AT guidovranken.nl>.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55432 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2016-06-17 23:52:48 +00:00
parent 34eb16651e
commit ed4aed86fb
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
Sat Jun 18 08:52:46 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
* ext/stringio/stringio.c (strio_getline): fix pointer index
overflow. reported by Guido Vranken <guido AT guidovranken.nl>.
Thu Jun 16 16:35:35 2016 Nobuyoshi Nakada <nobu@ruby-lang.org> Thu Jun 16 16:35:35 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
* class.c (Init_class_hierarchy): prevent rb_cObject which is the * class.c (Init_class_hierarchy): prevent rb_cObject which is the

2
ext/stringio/stringio.c
View File

@ -1021,7 +1021,7 @@ strio_getline(int argc, VALUE *argv, struct StringIO *ptr)
s = RSTRING_PTR(ptr->string); s = RSTRING_PTR(ptr->string);
e = s + RSTRING_LEN(ptr->string); e = s + RSTRING_LEN(ptr->string);
s += ptr->pos; s += ptr->pos;
if (limit > 0 && s + limit < e) { if (limit > 0 && (size_t)limit < (size_t)(e - s)) {
e = rb_enc_right_char_head(s, s + limit, e, get_enc(ptr)); e = rb_enc_right_char_head(s, s + limit, e, get_enc(ptr));
} }
if (NIL_P(str)) { if (NIL_P(str)) {

12
test/stringio/test_stringio.rb
View File

@ -680,4 +680,16 @@ class TestStringIO < Test::Unit::TestCase
StringIO.new {} StringIO.new {}
end end
end end
def test_overflow
limit = (1 << (RbConfig::SIZEOF["size_t"]*8-1)) - 0x10
assert_separately(%w[-rstringio], "#{<<-"begin;"}\n#{<<-"end;"}")
begin;
limit = #{limit}
x = ("a"*0x100000)
s = StringIO.new(x)
s.gets("xxx", limit)
assert_equal(0x100000, s.pos)
end;
end
end end