diff options
author | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
---|---|---|
committer | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
commit | 3af6dda231c26524b65a02f8212d91ce37618aa9 (patch) | |
tree | 51584d2db08f93d52c959a70299b9aae492b4075 /array.c | |
parent | a556543f74d2b35be8b3a67208ff68e758b7253a (diff) | |
download | ruby-3af6dda231c26524b65a02f8212d91ce37618aa9.tar.gz |
* array.c (ary_new, rb_ary_initialize, rb_ary_store,
rb_ary_aplice, rb_ary_times): integer overflows should be
checked. based on patches from Drew Yao <ayao at apple.com>
fixed CVE-2008-2726
* string.c (rb_str_buf_append): fixed unsafe use of alloca,
which led memory corruption. based on a patch from Drew Yao
<ayao at apple.com> fixed CVE-2008-2726
* sprintf.c (rb_str_format): backported from trunk.
* intern.h: ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'array.c')
-rw-r--r-- | array.c | 20 |
1 files changed, 12 insertions, 8 deletions
@@ -20,6 +20,7 @@ VALUE rb_cArray; static ID id_cmp; #define ARY_DEFAULT_SIZE 16 +#define ARY_MAX_SIZE (LONG_MAX / sizeof(VALUE)) void rb_mem_clear(register VALUE *mem, register long size) @@ -114,7 +115,7 @@ ary_new(VALUE klass, long len) if (len < 0) { rb_raise(rb_eArgError, "negative array size (or size too big)"); } - if (len > LONG_MAX / sizeof(VALUE)) { + if (len > ARY_MAX_SIZE) { rb_raise(rb_eArgError, "array size too big"); } ary = ary_alloc(klass); @@ -313,7 +314,7 @@ rb_ary_initialize(int argc, VALUE *argv, VALUE ary) if (len < 0) { rb_raise(rb_eArgError, "negative array size"); } - if (len > LONG_MAX / sizeof(VALUE)) { + if (len > ARY_MAX_SIZE) { rb_raise(rb_eArgError, "array size too big"); } rb_ary_modify(ary); @@ -371,6 +372,9 @@ rb_ary_store(VALUE ary, long idx, VALUE val) idx - RARRAY_LEN(ary)); } } + else if (idx >= ARY_MAX_SIZE) { + rb_raise(rb_eIndexError, "index %ld too big", idx); + } rb_ary_modify(ary); if (idx >= ARY_CAPA(ary)) { @@ -379,13 +383,10 @@ rb_ary_store(VALUE ary, long idx, VALUE val) if (new_capa < ARY_DEFAULT_SIZE) { new_capa = ARY_DEFAULT_SIZE; } - if (new_capa + idx < new_capa) { - rb_raise(rb_eArgError, "index too big"); + else if (new_capa >= ARY_MAX_SIZE - idx) { + new_capa = (ARY_MAX_SIZE - idx) / 2; } new_capa += idx; - if (new_capa * (long)sizeof(VALUE) <= new_capa) { - rb_raise(rb_eArgError, "index too big"); - } RESIZE_CAPA(ary, new_capa); } if (idx > RARRAY_LEN(ary)) { @@ -986,6 +987,9 @@ rb_ary_splice(VALUE ary, long beg, long len, VALUE rpl) rb_ary_modify(ary); if (beg >= RARRAY_LEN(ary)) { len = beg + rlen; + if (len < 0 || len > ARY_MAX_SIZE) { + rb_raise(rb_eIndexError, "index %ld too big", beg); + } if (len >= ARY_CAPA(ary)) { RESIZE_CAPA(ary, len); } @@ -2250,7 +2254,7 @@ rb_ary_times(VALUE ary, VALUE times) if (len < 0) { rb_raise(rb_eArgError, "negative argument"); } - if (LONG_MAX/len < RARRAY_LEN(ary)) { + if (ARY_MAX_SIZE/len < RARRAY_LEN(ary)) { rb_raise(rb_eArgError, "argument too big"); } len *= RARRAY_LEN(ary); |