summaryrefslogtreecommitdiffhomepage
path: root/src/string.c
diff options
context:
space:
mode:
authordearblue <[email protected]>2019-07-12 21:23:55 +0900
committerdearblue <[email protected]>2019-07-12 21:23:55 +0900
commitbde2f35a9f2d894ec88ad693633e89279b0560b9 (patch)
treeae75d7ab0cc31fb5400f46a7b84dd86a5b7a9738 /src/string.c
parentc5f0a0256b550f853de95a57ac9cb3845d0e064a (diff)
downloadmruby-bde2f35a9f2d894ec88ad693633e89279b0560b9.tar.gz
mruby-bde2f35a9f2d894ec88ad693633e89279b0560b9.zip
Fix heap buffer overflow; fix #4569
Diffstat (limited to 'src/string.c')
-rw-r--r--src/string.c24
1 files changed, 11 insertions, 13 deletions
diff --git a/src/string.c b/src/string.c
index 0700f81fa..056348921 100644
--- a/src/string.c
+++ b/src/string.c
@@ -324,22 +324,20 @@ str_index_str_by_char_search(mrb_state *mrb, const char *p, const char *pend, co
}
/* Searching */
- if (p < pend && pend - p >= slen) {
- for (;;) {
- const char *pivot;
+ while (p < pend && pend - p >= slen) {
+ const char *pivot;
- if (memcmp(p, s, slen) == 0) {
- return off;
- }
+ if (memcmp(p, s, slen) == 0) {
+ return off;
+ }
- pivot = p + qstable[(unsigned char)p[slen - 1]];
- if (pivot > pend || pivot < p /* overflowed */) { return -1; }
+ pivot = p + qstable[(unsigned char)p[slen - 1]];
+ if (pivot > pend || pivot < p /* overflowed */) { return -1; }
- do {
- p += utf8len(p, pend);
- off ++;
- } while (p < pivot);
- }
+ do {
+ p += utf8len(p, pend);
+ off ++;
+ } while (p < pivot);
}
return -1;