diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2021-09-05 16:41:08 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2021-09-05 16:41:08 +0900 |
| commit | 43abf36f00273726e4407007cbae38a04c011f87 (patch) | |
| tree | 04d1d90460b82076a8f00a7d9e55103bf8836065 /src/array.c | |
| parent | 7552b9322a736197f8a7f3cae92055c34a59067f (diff) | |
| download | mruby-43abf36f00273726e4407007cbae38a04c011f87.tar.gz mruby-43abf36f00273726e4407007cbae38a04c011f87.zip | |
array.c: check integer overflow before addition.
Diffstat (limited to 'src/array.c')
| -rw-r--r-- | src/array.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/array.c b/src/array.c index 6c9492a80..ae7c87bbc 100644 --- a/src/array.c +++ b/src/array.c @@ -742,9 +742,11 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val /* range check */ if (head < 0) { head += alen; - if (head < 0) { - mrb_raise(mrb, E_INDEX_ERROR, "index is out of array"); - } + if (head < 0) goto out_of_range; + } + if (head > MRB_INT_MAX - len) { + out_of_range: + mrb_raise(mrb, E_INDEX_ERROR, "index is out of array"); } tail = head + len; if (alen < len || alen < tail) { |