admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix heap buffer overflow in unpack_a; fix #4103

Browse Source
This commit is contained in:
Yukihiro "Matz" Matsumoto
2018-09-07 02:15:55 +09:00
parent fdaec90780
commit 04f8b0431c
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-pack/src/pack.c
+4 -2
View File
@@ -598,19 +598,21 @@ unpack_a(mrb_state *mrb, const void *src, int slen, mrb_value ary, long count, u
}
copylen = slen;
if (flags & PACK_FLAG_Z) { /* "Z" */
if (slen >= 0 && flags & PACK_FLAG_Z) { /* "Z" */
if ((cp = (const char *)memchr(sptr, '\0', slen)) != NULL) {
copylen = (int)(cp - sptr);
if (count == -1) {
slen = copylen + 1;
}
}
} else if (!(flags & PACK_FLAG_a)) { /* "A" */
}
else if (!(flags & PACK_FLAG_a)) { /* "A" */
while (copylen > 0 && (sptr[copylen - 1] == '\0' || isspace(sptr[copylen - 1]))) {
copylen--;
}
}
if (copylen < 0) copylen = 0;
dst = mrb_str_new(mrb, sptr, (mrb_int)copylen);
mrb_ary_push(mrb, ary, dst);
return slen;