admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

parse.y: fix buffer overflow with tweaked mruby binary.

Browse Source
This commit is contained in:
Yukihiro "Matz" Matsumoto
2022-01-28 15:31:22 +09:00
parent 0cd12c6d6f
commit 8252352d7b
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-compiler/core/parse.y
+6 -5
View File
@@ -6934,11 +6934,12 @@ mrb_load_detect_file_cxt(mrb_state *mrb, FILE *fp, mrbc_context *c)
binsize = bin_to_uint32(leading.h.binary_size);
bin_obj = mrb_str_new(mrb, NULL, binsize);
bin = (uint8_t *)RSTRING_PTR(bin_obj);
memcpy(bin, leading.b, bufsize);
if (binsize > bufsize &&
fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
if (binsize > bufsize) {
memcpy(bin, leading.b, bufsize);
if (fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
}
}
result = mrb_load_irep_buf_cxt(mrb, bin, binsize, c);
mrbgems/mruby-compiler/core/y.tab.c
+6 -5
View File
@@ -13161,11 +13161,12 @@ mrb_load_detect_file_cxt(mrb_state *mrb, FILE *fp, mrbc_context *c)
binsize = bin_to_uint32(leading.h.binary_size);
bin_obj = mrb_str_new(mrb, NULL, binsize);
bin = (uint8_t *)RSTRING_PTR(bin_obj);
memcpy(bin, leading.b, bufsize);
if (binsize > bufsize &&
fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
if (binsize > bufsize) {
memcpy(bin, leading.b, bufsize);
if (fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
}
}
result = mrb_load_irep_buf_cxt(mrb, bin, binsize, c);