diff options
| author | KOBAYASHI Shuji <[email protected]> | 2019-12-20 21:11:03 +0900 |
|---|---|---|
| committer | KOBAYASHI Shuji <[email protected]> | 2019-12-20 23:04:46 +0900 |
| commit | e8299a89da50c95bbaa459f2a969a58aad295bd1 (patch) | |
| tree | 4b65ae95550927a55e0f5777c05c4508130de79d /src/error.c | |
| parent | 19fa77ddbb439a91e0227848a2fa3e33d5e6c4ea (diff) | |
| download | mruby-e8299a89da50c95bbaa459f2a969a58aad295bd1.tar.gz mruby-e8299a89da50c95bbaa459f2a969a58aad295bd1.zip | |
Fix potentially crash in `%n` of `mrb_vformat()` with 64-bit `int`
If `mrb_sym` is smaller than `int`, it is promoted to `int`.
Diffstat (limited to 'src/error.c')
| -rw-r--r-- | src/error.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/error.c b/src/error.c index 126cd23fb..8ce92cef4 100644 --- a/src/error.c +++ b/src/error.c @@ -302,7 +302,11 @@ mrb_vformat(mrb_state *mrb, const char *format, va_list ap) mrb_gc_arena_restore(mrb, ai); break; case 'n': +#if UINT32_MAX < INT_MAX + obj = mrb_symbol_value((mrb_sym)va_arg(ap, int)); +#else obj = mrb_symbol_value(va_arg(ap, mrb_sym)); +#endif goto L_cat_obj; case 's': chars = va_arg(ap, char*); |