diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2015-05-29 02:03:13 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2015-05-29 02:03:13 +0900 |
| commit | 13a2cc3e5d27c33db7f4cf06ece4c44a79c79c53 (patch) | |
| tree | 8cd8b738d4ecefa40a6eb97ab1ad490fcb2050c4 | |
| parent | 55fed387a991c984ea2988b733ec42ebccfaaf2a (diff) | |
| parent | ce31272dba2a67772daeca34940c2e60cd183a85 (diff) | |
| download | mruby-13a2cc3e5d27c33db7f4cf06ece4c44a79c79c53.tar.gz mruby-13a2cc3e5d27c33db7f4cf06ece4c44a79c79c53.zip | |
Merge pull request #2807 from cremno/fix-capture-group-index-parsing-ub-bug
fix capture group index bug
| -rw-r--r-- | src/parse.y | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/parse.y b/src/parse.y index 76220499e..5b17649a9 100644 --- a/src/parse.y +++ b/src/parse.y @@ -5118,7 +5118,14 @@ parser_yylex(parser_state *p) pushback(p, c); if (last_state == EXPR_FNAME) goto gvar; tokfix(p); - yylval.nd = new_nth_ref(p, atoi(tok(p))); + { + unsigned long n = strtoul(tok(p), NULL, 10); + if (n > INT_MAX) { + yyerror_i(p, "capture group index must be <= %d", INT_MAX); + return 0; + } + yylval.nd = new_nth_ref(p, (int)n); + } return tNTH_REF; default: |