diff options
-rw-r--r-- | ChangeLog | 4 | ||||
-rw-r--r-- | compile.c | 2 |
2 files changed, 6 insertions, 0 deletions
@@ -1,3 +1,7 @@ +Fri Dec 18 16:50:35 2015 Koichi Sasada <ko1@atdot.net> + + * compile.c (ibf_load_setup): check tainted string argument. + Fri Dec 18 16:12:13 2015 Koichi Sasada <ko1@atdot.net> * vm_core.h: define USE_LAZY_LOAD if it is not defined. @@ -8203,6 +8203,8 @@ ibf_load_iseq(const struct ibf_load *load, const rb_iseq_t *index_iseq) static void ibf_load_setup(struct ibf_load *load, VALUE loader_obj, VALUE str) { + rb_check_safe_obj(str); + if (RSTRING_LENINT(str) < (int)sizeof(struct ibf_header)) { rb_raise(rb_eRuntimeError, "broken binary format"); } |