Merge branch 'master' into fix_mruby-io_test

2 files changed, 24 insertions, 17 deletions

diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index 927cc3a0f..ed8fc3150 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -102,6 +102,7 @@ codegen_error(codegen_scope *s, const char *message)
   while (s->prev) {
     codegen_scope *tmp = s->prev;
     mrb_free(s->mrb, s->iseq);
+    mrb_free(s->mrb, s->lines);
     mrb_pool_close(s->mpool);
     s = tmp;
   }
@@ -272,8 +273,7 @@ genop_W(codegen_scope *s, mrb_code i, uint32_t a)
 #define NOVAL  0
 #define VAL    1
 
-//static
-mrb_bool
+static mrb_bool
 no_optimize(codegen_scope *s)
 {
   if (s && s->parser && s->parser->no_optimize)
@@ -3020,6 +3020,9 @@ scope_finish(codegen_scope *s)
   mrb_state *mrb = s->mrb;
   mrb_irep *irep = s->irep;
 
+  if (s->nlocals >= 0x3ff) {
+    codegen_error(s, "too many local variables");
+  }
   irep->flags = 0;
   if (s->iseq) {
     irep->iseq = (mrb_code *)codegen_realloc(s, s->iseq, sizeof(mrb_code)*s->pc);
diff --git a/mrbgems/mruby-compiler/core/parse.y b/mrbgems/mruby-compiler/core/parse.y
index cb62ec3f2..7838b6dfb 100644
--- a/mrbgems/mruby-compiler/core/parse.y
+++ b/mrbgems/mruby-compiler/core/parse.y
@@ -3716,8 +3716,9 @@ yyerror_c(parser_state *p, const char *msg, char c)
 {
   char buf[256];
 
-  strcpy(buf, msg);
-  strcat(buf, &c);
+  strncpy(buf, msg, sizeof(buf) - 2);
+  buf[sizeof(buf) - 2] = '\0';
+  strncat(buf, &c, 1);
   yyerror(p, buf);
 }
 
@@ -3760,9 +3761,10 @@ yywarning_s(parser_state *p, const char *msg, const char *s)
 {
   char buf[256];
 
-  strcpy(buf, msg);
-  strcat(buf, ": ");
-  strcat(buf, s);
+  strncpy(buf, msg, sizeof(buf) - 1);
+  buf[sizeof(buf) - 1] = '\0';
+  strncat(buf, ": ", sizeof(buf) - strlen(buf) - 1);
+  strncat(buf, s, sizeof(buf) - strlen(buf) - 1);
   yywarning(p, buf);
 }
 
@@ -4326,11 +4328,12 @@ parse_string(parser_state *p)
 
         if (sizeof(s1)+sizeof(s2)+strlen(hinf->term)+1 >= sizeof(buf)) {
           yyerror(p, "can't find heredoc delimiter anywhere before EOF");
+        } else {
+          strcpy(buf, s1);
+          strcat(buf, hinf->term);
+          strcat(buf, s2);
+          yyerror(p, buf);
         }
-        strcpy(buf, s1);
-        strcat(buf, hinf->term);
-        strcat(buf, s2);
-        yyerror(p, buf);
         return 0;
       }
       pylval.nd = new_str(p, tok(p), toklen(p));
@@ -4487,7 +4490,7 @@ parse_string(parser_state *p)
         strcat(msg, "s");
       }
       strcat(msg, " - ");
-      strcat(msg, tok(p));
+      strncat(msg, tok(p), sizeof(msg) - strlen(msg) - 1);
       yyerror(p, msg);
     }
     if (f != 0) {
@@ -4918,7 +4921,7 @@ parser_yylex(parser_state *p)
           char cc = (char)c2;
 
           strcpy(buf, "invalid character syntax; use ?\\");
-          strcat(buf, &cc);
+          strncat(buf, &cc, 1);
           yyerror(p, buf);
         }
       }
@@ -5709,11 +5712,12 @@ parser_yylex(parser_state *p)
       if (!identchar(c)) {
         char buf[36];
         const char s[] = "Invalid char in expression: 0x";
+        const char hexdigits[] = "0123456789ABCDEF";
 
         strcpy(buf, s);
-        buf[sizeof(s)]   = (c & 0xff00) >> 8;
-        buf[sizeof(s)+1] = (c & 0xff);
-        buf[sizeof(s)+2] = 0;
+        buf[sizeof(s)-1] = hexdigits[(c & 0xf0) >> 4];
+        buf[sizeof(s)]   = hexdigits[(c & 0x0f)];
+        buf[sizeof(s)+1] = 0;
         yyerror(p, buf);
         goto retry;
       }
@@ -6147,7 +6151,7 @@ mrb_load_exec(mrb_state *mrb, struct mrb_parser_state *p, mrbc_context *c)
       strcpy(buf, "line ");
       dump_int(p->error_buffer[0].lineno, buf+5);
       strcat(buf, ": ");
-      strcat(buf, p->error_buffer[0].message);
+      strncat(buf, p->error_buffer[0].message, sizeof(buf) - strlen(buf) - 1);
       mrb->exc = mrb_obj_ptr(mrb_exc_new(mrb, E_SYNTAX_ERROR, buf, strlen(buf)));
       mrb_parser_free(p);
       return mrb_undef_value();