From 103f8bcad0aa237aec49272c42d1cf96464d29b3 Mon Sep 17 00:00:00 2001 From: Stephen Jothen Date: Sat, 25 Jun 2022 15:09:35 +0200 Subject: [PATCH] Fix out of bounds access by memcmp in String#rindex --- src/string.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/string.c b/src/string.c index 16f043fbf..262153107 100644 --- a/src/string.c +++ b/src/string.c @@ -637,7 +637,7 @@ str_replace(mrb_state *mrb, struct RString *s1, struct RString *s2) static mrb_int str_rindex(mrb_state *mrb, mrb_value str, mrb_value sub, mrb_int pos) { - const char *s, *sbeg, *t; + const char *s, *sbeg, *send, *t; struct RString *ps = mrb_str_ptr(str); mrb_int len = RSTRING_LEN(sub); @@ -647,12 +647,13 @@ str_rindex(mrb_state *mrb, mrb_value str, mrb_value sub, mrb_int pos) pos = RSTR_LEN(ps) - len; } sbeg = RSTR_PTR(ps); + send = sbeg + RSTR_LEN(ps); s = RSTR_PTR(ps) + pos; t = RSTRING_PTR(sub); if (len) { - s = char_adjust(sbeg, sbeg + RSTR_LEN(ps), s); + s = char_adjust(sbeg, send, s); while (sbeg <= s) { - if (memcmp(s, t, len) == 0) { + if ((mrb_int)(send - s) >= len && memcmp(s, t, len) == 0) { return (mrb_int)(s - RSTR_PTR(ps)); } s = char_backtrack(sbeg, s);