array.c: check integer overflow before addition.

This commit is contained in:
Yukihiro "Matz" Matsumoto
2021-09-05 16:41:08 +09:00
parent 7552b9322a
commit 43abf36f00
+5 -3
View File
@@ -742,9 +742,11 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val
/* range check */
if (head < 0) {
head += alen;
if (head < 0) {
mrb_raise(mrb, E_INDEX_ERROR, "index is out of array");
}
if (head < 0) goto out_of_range;
}
if (head > MRB_INT_MAX - len) {
out_of_range:
mrb_raise(mrb, E_INDEX_ERROR, "index is out of array");
}
tail = head + len;
if (alen < len || alen < tail) {