* array.c (ary_new, rb_ary_initialize, rb_ary_store,

  rb_ary_aplice, rb_ary_times): integer overflows should be
  checked. based on patches from Drew Yao <ayao at apple.com>
  fixed CVE-2008-2726

* string.c (rb_str_buf_append): fixed unsafe use of alloca,
  which led memory corruption. based on a patch from Drew Yao
  <ayao at apple.com> fixed CVE-2008-2726

* sprintf.c (rb_str_format): backported from trunk.

* intern.h: ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_6@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 1 insertions, 0 deletions

diff --git a/intern.h b/intern.h
index 47da14bb7a..b8af605292 100644
--- a/intern.h
+++ b/intern.h
@@ -400,6 +400,7 @@ const char *ruby_signal_name _((int));
 void ruby_default_signal _((int));
 /* sprintf.c */
 VALUE rb_f_sprintf _((int, VALUE*));
+VALUE rb_str_format _((int, VALUE*, VALUE));
 /* string.c */
 VALUE rb_str_new _((const char*, long));
 VALUE rb_str_new2 _((const char*));