diff options
author | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
---|---|---|
committer | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
commit | fe4947be523ce660aea7642881e3c6c4546cc712 (patch) | |
tree | 15d8f6a183c7dc6ffd6025eac011da5f8a97681f /string.c | |
parent | b950d6c499b04e26217ef049171fbad004ab7374 (diff) | |
download | ruby-fe4947be523ce660aea7642881e3c6c4546cc712.tar.gz ruby-fe4947be523ce660aea7642881e3c6c4546cc712.tar.xz ruby-fe4947be523ce660aea7642881e3c6c4546cc712.zip |
* array.c (ary_new, rb_ary_initialize, rb_ary_store,
rb_ary_aplice, rb_ary_times): integer overflows should be
checked. based on patches from Drew Yao <ayao at apple.com>
fixed CVE-2008-2726
* string.c (rb_str_buf_append): fixed unsafe use of alloca,
which led memory corruption. based on a patch from Drew Yao
<ayao at apple.com> fixed CVE-2008-2726
* sprintf.c (rb_str_format): backported from trunk.
* intern.h: ditto.
git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8_6@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'string.c')
-rw-r--r-- | string.c | 22 |
1 files changed, 9 insertions, 13 deletions
@@ -452,22 +452,15 @@ rb_str_times(str, times) */ static VALUE -rb_str_format(str, arg) +rb_str_format_m(str, arg) VALUE str, arg; { - VALUE *argv; + VALUE tmp = rb_check_array_type(arg); - if (TYPE(arg) == T_ARRAY) { - argv = ALLOCA_N(VALUE, RARRAY(arg)->len + 1); - argv[0] = str; - MEMCPY(argv+1, RARRAY(arg)->ptr, VALUE, RARRAY(arg)->len); - return rb_f_sprintf(RARRAY(arg)->len+1, argv); + if (!NIL_P(tmp)) { + return rb_str_format(RARRAY_LEN(tmp), RARRAY_PTR(tmp), str); } - - argv = ALLOCA_N(VALUE, 2); - argv[0] = str; - argv[1] = arg; - return rb_f_sprintf(2, argv); + return rb_str_format(1, &arg, str); } static int @@ -780,6 +773,9 @@ rb_str_buf_append(str, str2) capa = RSTRING(str)->aux.capa; } len = RSTRING(str)->len+RSTRING(str2)->len; + if (len < 0 || (capa+1) > LONG_MAX / 2) { + rb_raise(rb_eArgError, "string sizes too big"); + } if (capa <= len) { while (len > capa) { capa = (capa + 1) * 2; @@ -4657,7 +4653,7 @@ Init_String() rb_define_method(rb_cString, "casecmp", rb_str_casecmp, 1); rb_define_method(rb_cString, "+", rb_str_plus, 1); rb_define_method(rb_cString, "*", rb_str_times, 1); - rb_define_method(rb_cString, "%", rb_str_format, 1); + rb_define_method(rb_cString, "%", rb_str_format_m, 1); rb_define_method(rb_cString, "[]", rb_str_aref_m, -1); rb_define_method(rb_cString, "[]=", rb_str_aset_m, -1); rb_define_method(rb_cString, "insert", rb_str_insert, 2); |