diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2018-09-16 00:45:55 +0900 |
|---|---|---|
| committer | GitHub <[email protected]> | 2018-09-16 00:45:55 +0900 |
| commit | 05595c1284d50ccf7772b3c2f1e21d0047b7911b (patch) | |
| tree | 016d15d47a3b619b8c7b196c54c2232dce46bd85 /mrbgems/mruby-sprintf/src/sprintf.c | |
| parent | 2661ac70499601f28741be01e0ce82da0a4733bc (diff) | |
| parent | 2760cea4511135c30d6d9f6bb658ff86e62804d6 (diff) | |
| download | mruby-05595c1284d50ccf7772b3c2f1e21d0047b7911b.tar.gz mruby-05595c1284d50ccf7772b3c2f1e21d0047b7911b.zip | |
Merge pull request #4121 from clayton-shopify/fix-sprintf-overflow
Prevent signed integer overflow.
Diffstat (limited to 'mrbgems/mruby-sprintf/src/sprintf.c')
| -rw-r--r-- | mrbgems/mruby-sprintf/src/sprintf.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/mrbgems/mruby-sprintf/src/sprintf.c b/mrbgems/mruby-sprintf/src/sprintf.c index ea127c574..15d7b5464 100644 --- a/mrbgems/mruby-sprintf/src/sprintf.c +++ b/mrbgems/mruby-sprintf/src/sprintf.c @@ -200,7 +200,7 @@ check_name_arg(mrb_state *mrb, int posarg, const char *name, mrb_int len) #define GETNUM(n, val) \ for (; p < end && ISDIGIT(*p); p++) {\ - if (n > MRB_INT_MAX/10) {\ + if (n > (MRB_INT_MAX - (*p - '0'))/10) {\ mrb_raise(mrb, E_ARGUMENT_ERROR, #val " too big"); \ } \ n = 10 * n + (*p - '0'); \ @@ -1056,18 +1056,18 @@ retry: if (i > 0) need = BIT_DIGITS(i); } - need += (flags&FPREC) ? prec : 6; - if (need < 0) { + if (need > MRB_INT_MAX - ((flags&FPREC) ? prec : 6)) { too_big_width: mrb_raise(mrb, E_ARGUMENT_ERROR, (width > prec ? "width too big" : "prec too big")); } + need += (flags&FPREC) ? prec : 6; if ((flags&FWIDTH) && need < width) need = width; - need += 20; - if (need <= 0) { + if (need > MRB_INT_MAX - 20) { goto too_big_width; } + need += 20; CHECK(need); n = snprintf(&buf[blen], need, fbuf, fval); |