From e8299a89da50c95bbaa459f2a969a58aad295bd1 Mon Sep 17 00:00:00 2001
From: KOBAYASHI Shuji <shuujii@gmail.com>
Date: Fri, 20 Dec 2019 21:11:03 +0900
Subject: Fix potentially crash in `%n` of `mrb_vformat()` with 64-bit `int`

If `mrb_sym` is smaller than `int`, it is promoted to `int`.
---
 src/error.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'src/error.c')

diff --git a/src/error.c b/src/error.c
index 126cd23fb..8ce92cef4 100644
--- a/src/error.c
+++ b/src/error.c
@@ -302,7 +302,11 @@ mrb_vformat(mrb_state *mrb, const char *format, va_list ap)
           mrb_gc_arena_restore(mrb, ai);
           break;
         case 'n':
+#if UINT32_MAX < INT_MAX
+          obj = mrb_symbol_value((mrb_sym)va_arg(ap, int));
+#else
           obj = mrb_symbol_value(va_arg(ap, mrb_sym));
+#endif
           goto L_cat_obj;
         case 's':
           chars = va_arg(ap, char*);
-- 
cgit v1.2.3