diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2021-06-06 07:57:21 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2021-06-06 08:00:24 +0900 |
| commit | af3e0ddfc038c252731edf6cbaa6fdcee89331d8 (patch) | |
| tree | 19b3832deef1a931548154f2b6422a3e37c47b67 /mrbgems | |
| parent | f01c29b0ecbd0517ef854e2a769f41ec9af2ac08 (diff) | |
| download | mruby-af3e0ddfc038c252731edf6cbaa6fdcee89331d8.tar.gz mruby-af3e0ddfc038c252731edf6cbaa6fdcee89331d8.zip | |
pack.c: failed to detect overflow when `ch` is zero in `read_tmpl`.
Diffstat (limited to 'mrbgems')
| -rw-r--r-- | mrbgems/mruby-pack/src/pack.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/mrbgems/mruby-pack/src/pack.c b/mrbgems/mruby-pack/src/pack.c index 72d72ed7f..987385889 100644 --- a/mrbgems/mruby-pack/src/pack.c +++ b/mrbgems/mruby-pack/src/pack.c @@ -1131,8 +1131,8 @@ alias: if (ISDIGIT(ch)) { count = ch - '0'; while (tmpl->idx < tlen && ISDIGIT(tptr[tmpl->idx])) { - int ch = tptr[tmpl->idx++] - '0'; - if (count+ch > INT_MAX/10) { + ch = tptr[tmpl->idx++] - '0'; + if (count+10 > INT_MAX/10) { mrb_raise(mrb, E_RUNTIME_ERROR, "too big template length"); } count = count * 10 + ch; |