diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2016-12-13 10:48:36 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2016-12-13 10:48:36 +0900 |
| commit | 3a7c3695360e598ce4279a979cc9138a35971615 (patch) | |
| tree | 1c1d26d61c1527f4eefe24b42d7ca1a5068c3776 /src/string.c | |
| parent | 647ad29a7a1147e2c3ed93329cabbb974482697f (diff) | |
| download | mruby-3a7c3695360e598ce4279a979cc9138a35971615.tar.gz mruby-3a7c3695360e598ce4279a979cc9138a35971615.zip | |
Make sure str->capa is under MRB_INT_MAX; fix #3342
Diffstat (limited to 'src/string.c')
| -rw-r--r-- | src/string.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/string.c b/src/string.c index ee5aa04f3..dfe4fa3b1 100644 --- a/src/string.c +++ b/src/string.c @@ -156,14 +156,14 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len) else capa = s->as.heap.aux.capa; - if (RSTR_LEN(s) >= MRB_INT_MAX - (mrb_int)len) { + total = RSTR_LEN(s)+len; + if (total >= MRB_INT_MAX) { mrb_raise(mrb, E_ARGUMENT_ERROR, "string size too big"); } - total = RSTR_LEN(s)+len; if (capa <= total) { while (total > capa) { if (capa + 1 >= MRB_INT_MAX / 2) { - capa = (total + 4095) / 4096; + capa = MRB_INT_MAX; break; } capa = (capa + 1) * 2; |