diff options
| author | ksss <[email protected]> | 2016-12-23 23:30:35 +0900 |
|---|---|---|
| committer | ksss <[email protected]> | 2016-12-23 23:31:21 +0900 |
| commit | c626b823cabf8ee7acbdf57e44597de3974c5f17 (patch) | |
| tree | 1b9ddabc7f0cf37dc4b58e38e030015d606425b1 /src/string.c | |
| parent | 987daa64e387810e6871b9573bed97ae37d89a72 (diff) | |
| download | mruby-c626b823cabf8ee7acbdf57e44597de3974c5f17.tar.gz mruby-c626b823cabf8ee7acbdf57e44597de3974c5f17.zip | |
Check overflow string length
Fix #3360
Diffstat (limited to 'src/string.c')
| -rw-r--r-- | src/string.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/string.c b/src/string.c index ce27cdaa1..2d5006612 100644 --- a/src/string.c +++ b/src/string.c @@ -756,6 +756,9 @@ mrb_str_concat(mrb_state *mrb, mrb_value self, mrb_value other) s2 = mrb_str_ptr(other); len = RSTR_LEN(s1) + RSTR_LEN(s2); + if (len < 0 || len >= MRB_INT_MAX) { + mrb_raise(mrb, E_ARGUMENT_ERROR, "string size too big"); + } if (RSTRING_CAPA(self) < len) { resize_capa(mrb, s1, len); } |