diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2021-06-06 08:01:01 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2021-06-06 08:01:01 +0900 |
| commit | d518294f2076f3a2cb52996d7fc62aef7b56658e (patch) | |
| tree | 09121e2b86197c72e21027039d5288430f1d6496 | |
| parent | af3e0ddfc038c252731edf6cbaa6fdcee89331d8 (diff) | |
| download | mruby-d518294f2076f3a2cb52996d7fc62aef7b56658e.tar.gz mruby-d518294f2076f3a2cb52996d7fc62aef7b56658e.zip | |
pack.c: check overflow before reading count.
| -rw-r--r-- | mrbgems/mruby-pack/src/pack.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mrbgems/mruby-pack/src/pack.c b/mrbgems/mruby-pack/src/pack.c index 987385889..17009ee6a 100644 --- a/mrbgems/mruby-pack/src/pack.c +++ b/mrbgems/mruby-pack/src/pack.c @@ -1131,10 +1131,10 @@ alias: if (ISDIGIT(ch)) { count = ch - '0'; while (tmpl->idx < tlen && ISDIGIT(tptr[tmpl->idx])) { - ch = tptr[tmpl->idx++] - '0'; if (count+10 > INT_MAX/10) { mrb_raise(mrb, E_RUNTIME_ERROR, "too big template length"); } + ch = tptr[tmpl->idx++] - '0'; count = count * 10 + ch; } continue; /* special case */ |