summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorshyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2008-06-19 23:12:56 +0000
committershyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2008-06-19 23:12:56 +0000
commite62d2cb80c491a4337c1dfc6f580d06ea66b557e (patch)
tree51584d2db08f93d52c959a70299b9aae492b4075
parent27f1dd40c348a5ef2217e1043cc08e0c0832c702 (diff)
parent3af6dda231c26524b65a02f8212d91ce37618aa9 (diff)
add tag v1_9_0_2
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/tags/v1_9_0_2@17464 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--ChangeLog11
-rw-r--r--array.c20
-rw-r--r--string.c3
3 files changed, 26 insertions, 8 deletions
diff --git a/ChangeLog b/ChangeLog
index 7ca979c665..6a2d69eb2b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+Wed Jun 18 21:52:38 2008 URABE Shyouhei <shyouhei@ruby-lang.org>
+
+ * array.c (ary_new, rb_ary_initialize, rb_ary_store,
+ rb_ary_aplice, rb_ary_times): integer overflows should be
+ checked. based on patches from Drew Yao <ayao at apple.com>
+ fixed CVE-2008-2726
+
+ * string.c (rb_enc_cr_str_buf_cat): fixed unsafe use of alloca,
+ which led memory corruption. based on a patch from Drew Yao
+ <ayao at apple.com> fixed CVE-2008-2726
+
Fri Jun 20 03:26:00 2008 NAKAMURA Usaku <usa@ruby-lang.org>
* process.c (rb_f_fork): NetBSD 4.0 or later can fork.
diff --git a/array.c b/array.c
index 42fc2ebc60..46fd050669 100644
--- a/array.c
+++ b/array.c
@@ -20,6 +20,7 @@ VALUE rb_cArray;
static ID id_cmp;
#define ARY_DEFAULT_SIZE 16
+#define ARY_MAX_SIZE (LONG_MAX / sizeof(VALUE))
void
rb_mem_clear(register VALUE *mem, register long size)
@@ -114,7 +115,7 @@ ary_new(VALUE klass, long len)
if (len < 0) {
rb_raise(rb_eArgError, "negative array size (or size too big)");
}
- if (len > LONG_MAX / sizeof(VALUE)) {
+ if (len > ARY_MAX_SIZE) {
rb_raise(rb_eArgError, "array size too big");
}
ary = ary_alloc(klass);
@@ -313,7 +314,7 @@ rb_ary_initialize(int argc, VALUE *argv, VALUE ary)
if (len < 0) {
rb_raise(rb_eArgError, "negative array size");
}
- if (len > LONG_MAX / sizeof(VALUE)) {
+ if (len > ARY_MAX_SIZE) {
rb_raise(rb_eArgError, "array size too big");
}
rb_ary_modify(ary);
@@ -371,6 +372,9 @@ rb_ary_store(VALUE ary, long idx, VALUE val)
idx - RARRAY_LEN(ary));
}
}
+ else if (idx >= ARY_MAX_SIZE) {
+ rb_raise(rb_eIndexError, "index %ld too big", idx);
+ }
rb_ary_modify(ary);
if (idx >= ARY_CAPA(ary)) {
@@ -379,13 +383,10 @@ rb_ary_store(VALUE ary, long idx, VALUE val)
if (new_capa < ARY_DEFAULT_SIZE) {
new_capa = ARY_DEFAULT_SIZE;
}
- if (new_capa + idx < new_capa) {
- rb_raise(rb_eArgError, "index too big");
+ else if (new_capa >= ARY_MAX_SIZE - idx) {
+ new_capa = (ARY_MAX_SIZE - idx) / 2;
}
new_capa += idx;
- if (new_capa * (long)sizeof(VALUE) <= new_capa) {
- rb_raise(rb_eArgError, "index too big");
- }
RESIZE_CAPA(ary, new_capa);
}
if (idx > RARRAY_LEN(ary)) {
@@ -986,6 +987,9 @@ rb_ary_splice(VALUE ary, long beg, long len, VALUE rpl)
rb_ary_modify(ary);
if (beg >= RARRAY_LEN(ary)) {
len = beg + rlen;
+ if (len < 0 || len > ARY_MAX_SIZE) {
+ rb_raise(rb_eIndexError, "index %ld too big", beg);
+ }
if (len >= ARY_CAPA(ary)) {
RESIZE_CAPA(ary, len);
}
@@ -2250,7 +2254,7 @@ rb_ary_times(VALUE ary, VALUE times)
if (len < 0) {
rb_raise(rb_eArgError, "negative argument");
}
- if (LONG_MAX/len < RARRAY_LEN(ary)) {
+ if (ARY_MAX_SIZE/len < RARRAY_LEN(ary)) {
rb_raise(rb_eArgError, "argument too big");
}
len *= RARRAY_LEN(ary);
diff --git a/string.c b/string.c
index b962880d43..c19544deac 100644
--- a/string.c
+++ b/string.c
@@ -1562,6 +1562,9 @@ rb_enc_cr_str_buf_cat(VALUE str, const char *ptr, long len,
capa = RSTRING(str)->as.heap.aux.capa;
}
total = RSTRING_LEN(str)+len;
+ if (total < 0 || capa + 1 > LONG_MAX / 2) {
+ rb_raise(rb_eArgError, "string sizes too big");
+ }
if (capa <= total) {
while (total > capa) {
capa = (capa + 1) * 2;