From 5237b2cccc5f6d0484f7c4e4c42233bd312dd0d0 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Fri, 3 Mar 2023 14:21:05 +0900 Subject: [PATCH] mruby-io/file.c: atime, ctime, mtime check mrb_int overflow When `sizeof(time_t)` is different from `mrb_int`, overflow may happen. --- mrbgems/mruby-io/src/file.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mrbgems/mruby-io/src/file.c b/mrbgems/mruby-io/src/file.c index 731422b96..9fd266fb7 100644 --- a/mrbgems/mruby-io/src/file.c +++ b/mrbgems/mruby-io/src/file.c @@ -391,6 +391,8 @@ mrb_file__gethome(mrb_state *mrb, mrb_value klass) #endif } +#define TIME_OVERFLOW_P(a) (sizeof(time_t) <= sizeof(mrb_int) && (a > MRB_INT_MAX || a < MRB_INT_MIN)) + static mrb_value mrb_file_atime(mrb_state *mrb, mrb_value self) { @@ -399,6 +401,9 @@ mrb_file_atime(mrb_state *mrb, mrb_value self) if (mrb_fstat(fd, &st) == -1) mrb_sys_fail(mrb, "atime"); + if (TIME_OVERFLOW_P(st.st_atime)) { + mrb_raise(mrb, E_IO_ERROR, "atime overflow"); + } return mrb_int_value(mrb, (mrb_int)st.st_atime); } @@ -410,6 +415,9 @@ mrb_file_ctime(mrb_state *mrb, mrb_value self) if (mrb_fstat(fd, &st) == -1) mrb_sys_fail(mrb, "ctime"); + if (TIME_OVERFLOW_P(st.st_ctime)) { + mrb_raise(mrb, E_IO_ERROR, "ctime overflow"); + } return mrb_int_value(mrb, (mrb_int)st.st_ctime); } @@ -421,6 +429,9 @@ mrb_file_mtime(mrb_state *mrb, mrb_value self) if (mrb_fstat(fd, &st) == -1) mrb_sys_fail(mrb, "mtime"); + if (TIME_OVERFLOW_P(st.st_mtime)) { + mrb_raise(mrb, E_IO_ERROR, "mtime overflow"); + } return mrb_int_value(mrb, (mrb_int)st.st_mtime); }