Files
mruby-mruby/mrbgems
Yukihiro "Matz" Matsumoto 01ab2ffc29 mruby-io: fix buffer overflow in io#ungetc; fix #6647
io_unget_data had two issues that caused crashes with repeated ungetc:

1. Integer underflow in buffer size check: "len > MRB_IO_BUF_SIZE - buf->len"
   could underflow when buf->len was large, bypassing reallocation

2. Short overflow: buf->len could exceed SHRT_MAX after multiple ungetc
   calls, causing integer overflow when cast to short

Fixed by checking buf->len + len against both MRB_IO_BUF_SIZE and
SHRT_MAX before buffer operations.

Co-authored-by: Claude <noreply@anthropic.com>
2025-10-22 14:04:14 +09:00
..
2024-09-24 00:14:24 +10:00