diff options
| author | Craig Lehmann <[email protected]> | 2016-11-15 14:50:52 -0500 |
|---|---|---|
| committer | Bouke van der Bijl <[email protected]> | 2016-11-24 10:31:29 -0500 |
| commit | 83005d83d8ba95524436409d5d73fd82b63bc115 (patch) | |
| tree | b22a269b021111733ff99cc2ff968c9fdd9dedda /mrbgems/mruby-string-ext/src/string.c | |
| parent | a630c4f413f6af764e68210430e8b61a435d38d7 (diff) | |
| download | mruby-83005d83d8ba95524436409d5d73fd82b63bc115.tar.gz mruby-83005d83d8ba95524436409d5d73fd82b63bc115.zip | |
Read length after args in String#setbyte
Prevents RCE
Reported by https://hackerone.com/raydot
Diffstat (limited to 'mrbgems/mruby-string-ext/src/string.c')
| -rw-r--r-- | mrbgems/mruby-string-ext/src/string.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/mrbgems/mruby-string-ext/src/string.c b/mrbgems/mruby-string-ext/src/string.c index 122ee5454..dfac907ec 100644 --- a/mrbgems/mruby-string-ext/src/string.c +++ b/mrbgems/mruby-string-ext/src/string.c @@ -23,10 +23,11 @@ static mrb_value mrb_str_setbyte(mrb_state *mrb, mrb_value str) { mrb_int pos, byte; - long len = RSTRING_LEN(str); + long len; mrb_get_args(mrb, "ii", &pos, &byte); + len = RSTRING_LEN(str); if (pos < -len || len <= pos) mrb_raisef(mrb, E_INDEX_ERROR, "index %S is out of array", mrb_fixnum_value(pos)); if (pos < 0) |