From 46f0dbeacacd5e801fd3d83006889d83b2f3030f Mon Sep 17 00:00:00 2001 From: matz Date: Wed, 7 Dec 2005 06:36:38 +0000 Subject: * sprintf.c (rb_str_format): integer overflow check added. * sprintf.c (GETASTER): ditto. git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8@9653 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ChangeLog | 6 ++++++ sprintf.c | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1f881c4b0..ab35e1939 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +Wed Dec 7 15:31:35 2005 Yukihiro Matsumoto + + * sprintf.c (rb_str_format): integer overflow check added. + + * sprintf.c (GETASTER): ditto. + Wed Dec 7 01:02:04 2005 Hidetoshi NAGAI * ext/tk/README.macosx-aqua: [new document] tips to avoid the known diff --git a/sprintf.c b/sprintf.c index dabdc93e7..eddb7c33c 100644 --- a/sprintf.c +++ b/sprintf.c @@ -113,6 +113,9 @@ sign_bits(base, p) t = p++; \ n = 0; \ for (; p < end && ISDIGIT(*p); p++) { \ + if ((n*10) / 10 != n) { \ + rb_raise(rb_eArgError, #val " too big"); \ + } \ n = 10 * n + (*p - '0'); \ } \ if (p >= end) { \ @@ -309,6 +312,9 @@ rb_f_sprintf(argc, argv) case '5': case '6': case '7': case '8': case '9': n = 0; for (; p < end && ISDIGIT(*p); p++) { + if ((n*10) / 10 != n) { + rb_raise(rb_eArgError, "width too big"); + } n = 10 * n + (*p - '0'); } if (p >= end) { -- cgit