diff options
| author | rhe <rhe@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2016-09-26 02:09:50 +0000 |
|---|---|---|
| committer | rhe <rhe@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2016-09-26 02:09:50 +0000 |
| commit | e9237ada3c29b335be5effb8378414dea6467c88 (patch) | |
| tree | b0c71ecc1eaad41116f8122154d0cef8dbfa2e33 /ChangeLog | |
| parent | 49a4c6e25a0c85553d8432926e211acc21a91940 (diff) | |
| download | ruby-e9237ada3c29b335be5effb8378414dea6467c88.tar.gz | |
string.c: fix integer overflow in enc_strlen() and rb_enc_strlen_cr()
* string.c (enc_strlen, rb_enc_strlen_cr): Avoid signed integer
overflow. The result type of a pointer subtraction may have the same
size as long. This fixes String#size returning an negative value on
i686-linux environment:
str = "\x00" * ((1<<31)-2))
str.slice!(-3, 3)
str.force_encoding("UTF-32BE")
str << 1234
p str.size
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56247 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 13 |
1 files changed, 13 insertions, 0 deletions
@@ -1,3 +1,16 @@ +Mon Sep 26 11:06:47 2016 Kazuki Yamaguchi <k@rhe.jp> + + * string.c (enc_strlen, rb_enc_strlen_cr): Avoid signed integer + overflow. The result type of a pointer subtraction may have the same + size as long. This fixes String#size returning an negative value on + i686-linux environment: + + str = "\x00" * ((1<<31)-2)) + str.slice!(-3, 3) + str.force_encoding("UTF-32BE") + str << 1234 + p str.size + Sun Sep 25 22:48:06 2016 namusyaka <namusyaka@gmail.com> * lib/erb.rb (ERB::Compiler::TrimScanner#stag): The :stag accessor |