admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

load.c: fix off-by-one in bounds check for pool strings

Browse Source 
The bounds check for IREP_TT_STR pool data only validated
pool_data_len bytes, but the binary format includes a null
terminator after the string content. Both memcpy and the
source pointer advance by pool_data_len+1, so the check
must account for the extra byte.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-02-10 14:56:12 +09:00
parent 564995a91a
commit f80f1cd27d
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/load.c
+1 -1
View File
@@ -189,7 +189,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, const uint8_t *end, size_
case IREP_TT_STR:
pool_data_len = bin_to_uint16(src); /* pool data length */
src += sizeof(uint16_t);
if (src + pool_data_len > end) return FALSE;
if (src + pool_data_len + 1 > end) return FALSE;
if (st) {
pool[i].tt = (pool_data_len<<2) | IREP_TT_SSTR;
pool[i].u.str = (const char*)src;