pack.c: check overflow before reading count.

This commit is contained in:
Yukihiro "Matz" Matsumoto
2021-06-06 08:01:01 +09:00
parent af3e0ddfc0
commit d518294f20
+1 -1
View File
@@ -1131,10 +1131,10 @@ alias:
if (ISDIGIT(ch)) {
count = ch - '0';
while (tmpl->idx < tlen && ISDIGIT(tptr[tmpl->idx])) {
ch = tptr[tmpl->idx++] - '0';
if (count+10 > INT_MAX/10) {
mrb_raise(mrb, E_RUNTIME_ERROR, "too big template length");
}
ch = tptr[tmpl->idx++] - '0';
count = count * 10 + ch;
}
continue; /* special case */