summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorrhe <rhe@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2017-09-01 08:16:38 +0000
committerrhe <rhe@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2017-09-01 08:16:38 +0000
commitfc188f1646f3a925f0d5935d92f6a0131323413e (patch)
tree32f0d7685c7c133e362eebbba6e8b227ea3e41ad
parent99d64640c4d2f20aabe6115f95dab1a63d6f143f (diff)
object.c: fix potential oob write in rb_str_to_dbl()
Ensure space for the terminating NUL byte. Note that this code path is reachable only when Ruby is compiled with SHARABLE_MIDDLE_SUBSTRING=1. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59714 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--object.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/object.c b/object.c
index 378eb3a..0f91a1b 100644
--- a/object.c
+++ b/object.c
@@ -3302,7 +3302,7 @@ rb_str_to_dbl(VALUE str, int badcheck)
rb_raise(rb_eArgError, "string for Float contains null byte");
}
if (s[len]) { /* no sentinel somehow */
- char *p = ALLOCV(v, len);
+ char *p = ALLOCV(v, (size_t)len + 1);
MEMCPY(p, s, char, len);
p[len] = '\0';
s = p;