admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2820 from cremno/add-too-big-array-size-checks

Browse Source 
fix two potential cases of signed integer overflow
This commit is contained in:
Yukihiro "Matz" Matsumoto
2015-06-01 21:39:21 +09:00
parent 3739299823 dc0e335664
commit ddab53e66f
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/array.c
+6 -1
View File
@@ -298,6 +298,9 @@ mrb_ary_plus(mrb_state *mrb, mrb_value self)
mrb_int blen;
mrb_get_args(mrb, "a", &ptr, &blen);
if (ARY_MAX_SIZE - blen < a1->len) {
mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big");
}
ary = mrb_ary_new_capa(mrb, a1->len + blen);
a2 = mrb_ary_ptr(ary);
array_copy(a2->ptr, a1->ptr, a1->len);
@@ -351,7 +354,9 @@ mrb_ary_times(mrb_state *mrb, mrb_value self)
mrb_raise(mrb, E_ARGUMENT_ERROR, "negative argument");
}
if (times == 0) return mrb_ary_new(mrb);
if (ARY_MAX_SIZE / times < a1->len) {
mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big");
}
ary = mrb_ary_new_capa(mrb, a1->len * times);
a2 = mrb_ary_ptr(ary);
ptr = a2->ptr;