diff options
| author | cremno <[email protected]> | 2015-04-28 14:53:50 +0200 |
|---|---|---|
| committer | cremno <[email protected]> | 2015-04-28 15:02:39 +0200 |
| commit | 091ce867c104d0b1ad02dd7c34f13eef27b0ff39 (patch) | |
| tree | 7d18005bf3e370e632005c4addce16e821134bc4 /src/load.c | |
| parent | 0518ab22c4758712a78be436620d4e2cab69d7c2 (diff) | |
| download | mruby-091ce867c104d0b1ad02dd7c34f13eef27b0ff39.tar.gz mruby-091ce867c104d0b1ad02dd7c34f13eef27b0ff39.zip | |
fix possible unsigned integer underflow
buf_size has to be greater than header_size, otherwise subtracting
header_size from buf_size will cause an integer underflow.
Being equal to header_size is fine, however useless, so quit early.
Diffstat (limited to 'src/load.c')
| -rw-r--r-- | src/load.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/load.c b/src/load.c index 17bbb13eb..9854f712f 100644 --- a/src/load.c +++ b/src/load.c @@ -673,7 +673,7 @@ mrb_read_irep_file(mrb_state *mrb, FILE* fp) goto irep_exit; } result = read_binary_header(buf, &buf_size, NULL, &flags); - if (result != MRB_DUMP_OK) { + if (result != MRB_DUMP_OK || buf_size <= header_size) { goto irep_exit; } |
