diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2018-07-31 16:14:18 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2018-07-31 16:14:18 +0900 |
| commit | 180f39bf4c5246ff77ef71011a75e7669019afab (patch) | |
| tree | a943da11fffcaffdbb1725deef641678b139526c | |
| parent | b09d2eb90074c50ed83d4d10d3fe0393bc9e43da (diff) | |
| download | mruby-180f39bf4c5246ff77ef71011a75e7669019afab.tar.gz mruby-180f39bf4c5246ff77ef71011a75e7669019afab.zip | |
Check size of the integer multiply before actual overflow; fix #4062
| -rw-r--r-- | mrbgems/mruby-sprintf/src/sprintf.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/mrbgems/mruby-sprintf/src/sprintf.c b/mrbgems/mruby-sprintf/src/sprintf.c index 7eea1a1f3..738c5485f 100644 --- a/mrbgems/mruby-sprintf/src/sprintf.c +++ b/mrbgems/mruby-sprintf/src/sprintf.c @@ -119,13 +119,11 @@ mrb_fix2binstr(mrb_state *mrb, mrb_value x, int base) #define FPREC0 128 #define CHECK(l) do {\ -/* int cr = ENC_CODERANGE(result);*/\ while ((l) >= bsiz - blen) {\ + if (bsiz > MRB_INT_MAX/2) mrb_raise(mrb, E_ARGUMENT_ERROR, "too big specifier"); \ bsiz*=2;\ - if (bsiz < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "too big specifier"); \ }\ mrb_str_resize(mrb, result, bsiz);\ -/* ENC_CODERANGE_SET(result, cr);*/\ buf = RSTRING_PTR(result);\ } while (0) @@ -202,11 +200,10 @@ check_name_arg(mrb_state *mrb, int posarg, const char *name, mrb_int len) #define GETNUM(n, val) \ for (; p < end && ISDIGIT(*p); p++) {\ - mrb_int next_n = 10 * n + (*p - '0'); \ - if (next_n / 10 != n) {\ + if (n > MRB_INT_MAX/10) {\ mrb_raise(mrb, E_ARGUMENT_ERROR, #val " too big"); \ } \ - n = next_n; \ + n = 10 * n + (*p - '0'); \ } \ if (p >= end) { \ mrb_raise(mrb, E_ARGUMENT_ERROR, "malformed format string - %*[0-9]"); \ |