str_buf_cat(): should allocate at least RSTRING_EMBED_LEN_MAX+1.

This commit is contained in:
Yukihiro "Matz" Matsumoto
2016-12-31 23:31:45 +09:00
parent cfdd1e3cc6
commit 342b1de65c
+2
View File
@@ -158,6 +158,8 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
capa = RSTRING_EMBED_LEN_MAX;
else
capa = s->as.heap.aux.capa;
if (capa <= RSTRING_EMBED_LEN_MAX)
capa = RSTRING_EMBED_LEN_MAX+1;
total = RSTR_LEN(s)+len;
if (total >= MRB_INT_MAX) {