admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Check iseq buffer size before code emission; fix #4090

Browse Source 
The type of `s->pc` is now `uint16_t` that can be overflowed easily.
Need more checks.
This commit is contained in:
Yukihiro "Matz" Matsumoto
2018-08-29 12:31:48 +09:00
parent 814b7b5ef8
commit bc88fc6ed1
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-compiler/core/codegen.c
+5 -6
View File
@@ -151,11 +151,11 @@ new_label(codegen_scope *s)
static void
emit_B(codegen_scope *s, uint32_t pc, uint8_t i)
{
if (pc >= MAXARG_S || s->icapa >= MAXARG_S) {
codegen_error(s, "too big code block");
}
if (pc >= s->icapa) {
s->icapa *= 2;
if (pc >= MAXARG_S) {
codegen_error(s, "too big code block");
}
if (s->icapa > MAXARG_S) {
s->icapa = MAXARG_S;
}
@@ -184,7 +184,8 @@ emit_S(codegen_scope *s, int pc, uint16_t i)
static void
gen_B(codegen_scope *s, uint8_t i)
{
emit_B(s, s->pc++, i);
emit_B(s, s->pc, i);
s->pc++;
}
static void
@@ -248,7 +249,6 @@ genop_2(codegen_scope *s, mrb_code i, uint16_t a, uint16_t b)
static void
genop_3(codegen_scope *s, mrb_code i, uint16_t a, uint16_t b, uint8_t c)
{
s->lastpc = s->pc;
genop_2(s, i, a, b);
gen_B(s, c);
}
@@ -256,7 +256,6 @@ genop_3(codegen_scope *s, mrb_code i, uint16_t a, uint16_t b, uint8_t c)
static void
genop_2S(codegen_scope *s, mrb_code i, uint16_t a, uint16_t b)
{
s->lastpc = s->pc;
genop_1(s, i, a);
gen_S(s, b);
}