diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2019-12-21 01:18:09 +0900 |
|---|---|---|
| committer | GitHub <[email protected]> | 2019-12-21 01:18:09 +0900 |
| commit | ef8621cb6145cda0a1c72273f59c1192450affcf (patch) | |
| tree | 4b65ae95550927a55e0f5777c05c4508130de79d | |
| parent | 19fa77ddbb439a91e0227848a2fa3e33d5e6c4ea (diff) | |
| parent | e8299a89da50c95bbaa459f2a969a58aad295bd1 (diff) | |
| download | mruby-ef8621cb6145cda0a1c72273f59c1192450affcf.tar.gz mruby-ef8621cb6145cda0a1c72273f59c1192450affcf.zip | |
Merge pull request #4885 from shuujii/fix-potentially-crash-in-%n-of-mrb_vformat-with-64-bit-int
Fix potentially crash in `%n` of `mrb_vformat()` with 64-bit `int`
| -rw-r--r-- | src/error.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/error.c b/src/error.c index 126cd23fb..8ce92cef4 100644 --- a/src/error.c +++ b/src/error.c @@ -302,7 +302,11 @@ mrb_vformat(mrb_state *mrb, const char *format, va_list ap) mrb_gc_arena_restore(mrb, ai); break; case 'n': +#if UINT32_MAX < INT_MAX + obj = mrb_symbol_value((mrb_sym)va_arg(ap, int)); +#else obj = mrb_symbol_value(va_arg(ap, mrb_sym)); +#endif goto L_cat_obj; case 's': chars = va_arg(ap, char*); |