diff options
| author | Craig Lehmann <[email protected]> | 2016-11-15 14:50:52 -0500 |
|---|---|---|
| committer | Bouke van der Bijl <[email protected]> | 2016-11-24 10:31:29 -0500 |
| commit | 83005d83d8ba95524436409d5d73fd82b63bc115 (patch) | |
| tree | b22a269b021111733ff99cc2ff968c9fdd9dedda /mrbgems/mruby-string-ext/test/string.rb | |
| parent | a630c4f413f6af764e68210430e8b61a435d38d7 (diff) | |
| download | mruby-83005d83d8ba95524436409d5d73fd82b63bc115.tar.gz mruby-83005d83d8ba95524436409d5d73fd82b63bc115.zip | |
Read length after args in String#setbyte
Prevents RCE
Reported by https://hackerone.com/raydot
Diffstat (limited to 'mrbgems/mruby-string-ext/test/string.rb')
| -rw-r--r-- | mrbgems/mruby-string-ext/test/string.rb | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/mrbgems/mruby-string-ext/test/string.rb b/mrbgems/mruby-string-ext/test/string.rb index a5d55a7ee..228a236af 100644 --- a/mrbgems/mruby-string-ext/test/string.rb +++ b/mrbgems/mruby-string-ext/test/string.rb @@ -30,6 +30,18 @@ assert('String#setbyte') do assert_equal("Hello", str1) end +assert("String#setbyte raises IndexError if arg conversion resizes String") do + $s = "01234\n" + class Tmp + def to_i + $s.chomp! '' + 95 + end + end + tmp = Tmp.new + assert_raise(IndexError) { $s.setbyte(5, tmp) } +end + assert('String#byteslice') do str1 = "hello" assert_equal("e", str1.byteslice(1)) |