mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
Merge pull request #4573 from dearblue/fix-4569
Fix heap buffer overflow; fix #4569
This commit is contained in:
+12
-14
@@ -324,22 +324,20 @@ str_index_str_by_char_search(mrb_state *mrb, const char *p, const char *pend, co
|
||||
}
|
||||
|
||||
/* Searching */
|
||||
if (p < pend && pend - p >= slen) {
|
||||
for (;;) {
|
||||
const char *pivot;
|
||||
while (p < pend && pend - p >= slen) {
|
||||
const char *pivot;
|
||||
|
||||
if (memcmp(p, s, slen) == 0) {
|
||||
return off;
|
||||
}
|
||||
|
||||
pivot = p + qstable[(unsigned char)p[slen - 1]];
|
||||
if (pivot > pend || pivot < p /* overflowed */) { return -1; }
|
||||
|
||||
do {
|
||||
p += utf8len(p, pend);
|
||||
off ++;
|
||||
} while (p < pivot);
|
||||
if (memcmp(p, s, slen) == 0) {
|
||||
return off;
|
||||
}
|
||||
|
||||
pivot = p + qstable[(unsigned char)p[slen - 1]];
|
||||
if (pivot > pend || pivot < p /* overflowed */) { return -1; }
|
||||
|
||||
do {
|
||||
p += utf8len(p, pend);
|
||||
off ++;
|
||||
} while (p < pivot);
|
||||
}
|
||||
|
||||
return -1;
|
||||
|
||||
Reference in New Issue
Block a user