diff options
| author | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2003-12-21 15:38:01 +0000 |
|---|---|---|
| committer | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2003-12-21 15:38:01 +0000 |
| commit | a7b3a428501a855e3caee42474121fe8f387daf5 (patch) | |
| tree | ec1ea3bdec11df1b37063937b549eedb4048638d /ext/syck | |
| parent | f8b298c5f94efd6405d9b34967b72235f7f3a3fa (diff) | |
* ext/syck/emitter.c (syck_emitter_write): str bigger than
e->bufsize causes buffer overflow. [ruby-dev:22307]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@5239 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'ext/syck')
| -rw-r--r-- | ext/syck/emitter.c | 11 | ||||
| -rw-r--r-- | ext/syck/rubyext.c | 4 |
2 files changed, 12 insertions, 3 deletions
diff --git a/ext/syck/emitter.c b/ext/syck/emitter.c index 1cc0ea5075..4dcc8b3fc5 100644 --- a/ext/syck/emitter.c +++ b/ext/syck/emitter.c @@ -232,9 +232,18 @@ syck_emitter_write( SyckEmitter *e, char *str, long len ) * Flush if at end of buffer */ at = e->marker - e->buffer; - if ( len + at > e->bufsize ) + if ( len + at >= e->bufsize ) { syck_emitter_flush( e, 0 ); + for (;;) { + long rest = e->bufsize - (e->marker - e->buffer); + if (len <= rest) break; + S_MEMCPY( e->marker, str, char, rest ); + e->marker += len; + str += rest; + len -= rest; + syck_emitter_flush( e, 0 ); + } } /* diff --git a/ext/syck/rubyext.c b/ext/syck/rubyext.c index 3722babc39..ecb39c344a 100644 --- a/ext/syck/rubyext.c +++ b/ext/syck/rubyext.c @@ -845,7 +845,7 @@ syck_loader_initialize( self ) { VALUE families; - rb_iv_set(self, "@families", rb_hash_new() ); + rb_iv_set(self, "@families", rb_hash_new() ); rb_iv_set(self, "@private_types", rb_hash_new() ); rb_iv_set(self, "@anchors", rb_hash_new() ); families = rb_iv_get(self, "@families"); @@ -853,7 +853,7 @@ syck_loader_initialize( self ) rb_hash_aset(families, rb_str_new2( YAML_DOMAIN ), rb_hash_new()); rb_hash_aset(families, rb_str_new2( RUBY_DOMAIN ), rb_hash_new()); - return self; + return self; } /* |