From 2f4695b759d9b84bddcab0242f9b34693bdc7ed4 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Wed, 25 May 2022 11:20:29 +0900 Subject: [PATCH] mruby-string-ext/string.c: check sequence length before decoding. --- mrbgems/mruby-string-ext/src/string.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mrbgems/mruby-string-ext/src/string.c b/mrbgems/mruby-string-ext/src/string.c index 666e59db9..394583da9 100644 --- a/mrbgems/mruby-string-ext/src/string.c +++ b/mrbgems/mruby-string-ext/src/string.c @@ -1002,7 +1002,7 @@ static const char utf8len_codepage_zero[256] = }; static mrb_int -utf8code(unsigned char* p) +utf8code(unsigned char* p, mrb_int limit) { mrb_int len; @@ -1010,7 +1010,7 @@ utf8code(unsigned char* p) return p[0]; len = utf8len_codepage_zero[p[0]]; - if (len > 1 && (p[1] & 0xc0) == 0x80) { + if (len <= limit && len > 1 && (p[1] & 0xc0) == 0x80) { if (len == 2) return ((p[0] & 0x1f) << 6) + (p[1] & 0x3f); if ((p[2] & 0xc0) == 0x80) { @@ -1042,7 +1042,7 @@ mrb_str_ord(mrb_state* mrb, mrb_value str) { if (RSTRING_LEN(str) == 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "empty string"); - mrb_int c = utf8code((unsigned char*) RSTRING_PTR(str)); + mrb_int c = utf8code((unsigned char*)RSTRING_PTR(str), RSTRING_LEN(str)); if (c < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "invalid UTF-8 byte sequence"); return mrb_fixnum_value(c); }