diff options
| author | ocean <ocean@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2006-02-03 06:11:13 +0000 |
|---|---|---|
| committer | ocean <ocean@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2006-02-03 06:11:13 +0000 |
| commit | 6a77561e31193a2e256cbd4a2a267fe905fa868c (patch) | |
| tree | d56e50972c87518412b212784274726b580bdb3d /ext | |
| parent | c7d65f5b85b2fdab8987f77abe78cb682358e236 (diff) | |
| download | ruby-6a77561e31193a2e256cbd4a2a267fe905fa868c.tar.gz ruby-6a77561e31193a2e256cbd4a2a267fe905fa868c.tar.xz ruby-6a77561e31193a2e256cbd4a2a267fe905fa868c.zip | |
* ext/syck/syck.c (syck_move_tokens): should reset p->cursor or etc
even if skip == 0. This causes buffer overrun.
(ex: YAML.load('--- "..' + '\x82\xA0' * 511 + '"'))
git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8@9878 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/syck/syck.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/ext/syck/syck.c b/ext/syck/syck.c index 33f9bf23e..24a56a5e4 100644 --- a/ext/syck/syck.c +++ b/ext/syck/syck.c @@ -410,9 +410,6 @@ syck_move_tokens( SyckParser *p ) return 0; skip = p->limit - p->token; - if ( skip < 1 ) - return 0; - if ( ( count = p->token - p->buffer ) ) { S_MEMMOVE( p->buffer, p->token, char, skip ); |