mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
Fix potential overflow in utf8len()
For example on 32 bit mode, when `p = 0xfffffffd`, `e = 0xfffffffe` and `len = 4`, the sum of `p` and `len` can be to `1`, and comparison with `e` will to be false. As a result, a segmentation fault occurs by referring to address 0.
This commit is contained in:
+1
-1
@@ -234,7 +234,7 @@ utf8len(const char* p, const char* e)
|
||||
mrb_int i;
|
||||
|
||||
len = utf8len_codepage[(unsigned char)*p];
|
||||
if (p + len > e) return 1;
|
||||
if (len > e - p) return 1;
|
||||
for (i = 1; i < len; ++i)
|
||||
if ((p[i] & 0xc0) != 0x80)
|
||||
return 1;
|
||||
|
||||
Reference in New Issue
Block a user