diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2018-07-31 16:14:18 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2018-08-25 09:13:09 +0900 |
| commit | bfd11aab35ab942363359a989712e9a6f35b9295 (patch) | |
| tree | 80c2a60a9d3447a6ddd53a11044c4f186bd82404 | |
| parent | d88667669048d45a48c0920866b890b1a821e07a (diff) | |
| download | mruby-bfd11aab35ab942363359a989712e9a6f35b9295.tar.gz mruby-bfd11aab35ab942363359a989712e9a6f35b9295.zip | |
Check size of the integer multiply before actual overflow; fix #4062
| -rw-r--r-- | mrbgems/mruby-sprintf/src/sprintf.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/mrbgems/mruby-sprintf/src/sprintf.c b/mrbgems/mruby-sprintf/src/sprintf.c index 7eea1a1f3..738c5485f 100644 --- a/mrbgems/mruby-sprintf/src/sprintf.c +++ b/mrbgems/mruby-sprintf/src/sprintf.c @@ -119,13 +119,11 @@ mrb_fix2binstr(mrb_state *mrb, mrb_value x, int base) #define FPREC0 128 #define CHECK(l) do {\ -/* int cr = ENC_CODERANGE(result);*/\ while ((l) >= bsiz - blen) {\ + if (bsiz > MRB_INT_MAX/2) mrb_raise(mrb, E_ARGUMENT_ERROR, "too big specifier"); \ bsiz*=2;\ - if (bsiz < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "too big specifier"); \ }\ mrb_str_resize(mrb, result, bsiz);\ -/* ENC_CODERANGE_SET(result, cr);*/\ buf = RSTRING_PTR(result);\ } while (0) @@ -202,11 +200,10 @@ check_name_arg(mrb_state *mrb, int posarg, const char *name, mrb_int len) #define GETNUM(n, val) \ for (; p < end && ISDIGIT(*p); p++) {\ - mrb_int next_n = 10 * n + (*p - '0'); \ - if (next_n / 10 != n) {\ + if (n > MRB_INT_MAX/10) {\ mrb_raise(mrb, E_ARGUMENT_ERROR, #val " too big"); \ } \ - n = next_n; \ + n = 10 * n + (*p - '0'); \ } \ if (p >= end) { \ mrb_raise(mrb, E_ARGUMENT_ERROR, "malformed format string - %*[0-9]"); \ |