admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Countermeasure to overflow for String#bytesplice

Browse Source
This commit is contained in:
dearblue
2023-04-15 21:25:58 +09:00
parent 73b6c6619c
commit dcced0016c
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/string.c
+3 -2
View File
@@ -2950,10 +2950,11 @@ str_bytesplice(mrb_state *mrb, mrb_value str, mrb_int idx1, mrb_int len1, mrb_va
if (RSTR_LEN(s) < idx1 || RSTRING_LEN(replace) < idx2) {
mrb_raise(mrb, E_INDEX_ERROR, "index out of string");
}
if (RSTR_LEN(s) <= idx1+len1) {
mrb_int n;
if (mrb_int_add_overflow(idx1, len1, &n) || RSTR_LEN(s) < n) {
len1 = RSTR_LEN(s) - idx1;
}
if (RSTRING_LEN(replace) <= idx2+len2) {
if (mrb_int_add_overflow(idx2, len2, &n) || RSTRING_LEN(replace) < n) {
len2 = RSTRING_LEN(replace) - idx2;
}
if (len2 == 0) return str;
test/t/string.rb
+4
View File
@@ -951,4 +951,8 @@ assert('String#bytesplice') do
# check the object type to replace
assert_raise(TypeError) { "0123456789".bytesplice(1, 1, Object.new) }
# check the overflow to index and length (to be pass without crash)
assert_nothing_raised { "0123456789".bytesplice(8, ~(-1 << 31), "ab") } # for MRB_INT32
assert_nothing_raised { begin; "0123456789".bytesplice(8, ~(-1 << 63), "ab"); rescue ArgumentError, RangeError; end } # for MRB_INT64
end