diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2018-02-09 12:55:13 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2018-02-09 12:55:13 +0900 |
| commit | 4c1494d58fbccbd6363060cadfc8420480bf87e8 (patch) | |
| tree | 0e23e8fd6fbfb68aa323a852ef8eb91b61d31526 /mrbgems/mruby-pack | |
| parent | b43c146455d16695d0b5bf70448e5470fe560639 (diff) | |
| download | mruby-4c1494d58fbccbd6363060cadfc8420480bf87e8.tar.gz mruby-4c1494d58fbccbd6363060cadfc8420480bf87e8.zip | |
Check if `mruby-pack` template count overflow; fix #3942
Diffstat (limited to 'mrbgems/mruby-pack')
| -rw-r--r-- | mrbgems/mruby-pack/src/pack.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/mrbgems/mruby-pack/src/pack.c b/mrbgems/mruby-pack/src/pack.c index ceb862d3f..30139fb74 100644 --- a/mrbgems/mruby-pack/src/pack.c +++ b/mrbgems/mruby-pack/src/pack.c @@ -1050,6 +1050,9 @@ alias: count = ch - '0'; while (tmpl->idx < tlen && isdigit(tptr[tmpl->idx])) { count = count * 10 + (tptr[tmpl->idx++] - '0'); + if (count < 0) { + mrb_raisef(mrb, E_RUNTIME_ERROR, "too big template length"); + } } continue; /* special case */ } else if (ch == '*') { |