Fix potential overflow in utf8len()

For example on 32 bit mode, when `p = 0xfffffffd`, `e = 0xfffffffe`
and `len = 4`, the sum of `p` and `len` can be to `1`, and comparison
with `e` will to be false.

As a result, a segmentation fault occurs by referring to address 0.
This commit is contained in:
dearblue
2019-06-22 16:48:22 +09:00
parent c53b7cedcc
commit 7583539029
+1 -1
View File
@@ -234,7 +234,7 @@ utf8len(const char* p, const char* e)
mrb_int i;
len = utf8len_codepage[(unsigned char)*p];
if (p + len > e) return 1;
if (len > e - p) return 1;
for (i = 1; i < len; ++i)
if ((p[i] & 0xc0) != 0x80)
return 1;