diff options
| author | dearblue <[email protected]> | 2019-07-12 21:23:55 +0900 |
|---|---|---|
| committer | dearblue <[email protected]> | 2019-07-12 21:23:55 +0900 |
| commit | bde2f35a9f2d894ec88ad693633e89279b0560b9 (patch) | |
| tree | ae75d7ab0cc31fb5400f46a7b84dd86a5b7a9738 /src/string.c | |
| parent | c5f0a0256b550f853de95a57ac9cb3845d0e064a (diff) | |
| download | mruby-bde2f35a9f2d894ec88ad693633e89279b0560b9.tar.gz mruby-bde2f35a9f2d894ec88ad693633e89279b0560b9.zip | |
Fix heap buffer overflow; fix #4569
Diffstat (limited to 'src/string.c')
| -rw-r--r-- | src/string.c | 24 |
1 files changed, 11 insertions, 13 deletions
diff --git a/src/string.c b/src/string.c index 0700f81fa..056348921 100644 --- a/src/string.c +++ b/src/string.c @@ -324,22 +324,20 @@ str_index_str_by_char_search(mrb_state *mrb, const char *p, const char *pend, co } /* Searching */ - if (p < pend && pend - p >= slen) { - for (;;) { - const char *pivot; + while (p < pend && pend - p >= slen) { + const char *pivot; - if (memcmp(p, s, slen) == 0) { - return off; - } + if (memcmp(p, s, slen) == 0) { + return off; + } - pivot = p + qstable[(unsigned char)p[slen - 1]]; - if (pivot > pend || pivot < p /* overflowed */) { return -1; } + pivot = p + qstable[(unsigned char)p[slen - 1]]; + if (pivot > pend || pivot < p /* overflowed */) { return -1; } - do { - p += utf8len(p, pend); - off ++; - } while (p < pivot); - } + do { + p += utf8len(p, pend); + off ++; + } while (p < pivot); } return -1; |
