diff options
author | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
---|---|---|
committer | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
commit | 3af6dda231c26524b65a02f8212d91ce37618aa9 (patch) | |
tree | 51584d2db08f93d52c959a70299b9aae492b4075 /string.c | |
parent | a556543f74d2b35be8b3a67208ff68e758b7253a (diff) | |
download | ruby-3af6dda231c26524b65a02f8212d91ce37618aa9.tar.gz |
* array.c (ary_new, rb_ary_initialize, rb_ary_store,
rb_ary_aplice, rb_ary_times): integer overflows should be
checked. based on patches from Drew Yao <ayao at apple.com>
fixed CVE-2008-2726
* string.c (rb_str_buf_append): fixed unsafe use of alloca,
which led memory corruption. based on a patch from Drew Yao
<ayao at apple.com> fixed CVE-2008-2726
* sprintf.c (rb_str_format): backported from trunk.
* intern.h: ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'string.c')
-rw-r--r-- | string.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -1562,6 +1562,9 @@ rb_enc_cr_str_buf_cat(VALUE str, const char *ptr, long len, capa = RSTRING(str)->as.heap.aux.capa; } total = RSTRING_LEN(str)+len; + if (total < 0 || capa + 1 > LONG_MAX / 2) { + rb_raise(rb_eArgError, "string sizes too big"); + } if (capa <= total) { while (total > capa) { capa = (capa + 1) * 2; |