diff options
author | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
---|---|---|
committer | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-19 23:12:46 +0000 |
commit | 60243650cff2fbf678806bed4b0d57c6209d10cc (patch) | |
tree | cc4e6fa1dff263effcfdcdbb4ae6c0ef410faf7f /sprintf.c | |
parent | 5f61a11989379a24e8bf2ca09ae52de27b607ff8 (diff) |
* array.c (ary_new, rb_ary_initialize, rb_ary_store,
rb_ary_aplice, rb_ary_times): integer overflows should be
checked. based on patches from Drew Yao <ayao at apple.com>
fixed CVE-2008-2726
* string.c (rb_str_buf_append): fixed unsafe use of alloca,
which led memory corruption. based on a patch from Drew Yao
<ayao at apple.com> fixed CVE-2008-2726
* sprintf.c (rb_str_format): backported from trunk.
* intern.h: ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_5@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'sprintf.c')
-rw-r--r-- | sprintf.c | 11 |
1 files changed, 10 insertions, 1 deletions
@@ -247,7 +247,15 @@ rb_f_sprintf(argc, argv) int argc; VALUE *argv; { + return rb_str_format(argc - 1, argv + 1, GETNTHARG(0)); +} + +VALUE +rb_str_format(argc, argv, fmt) + int argc; + VALUE *argv; VALUE fmt; +{ const char *p, *end; char *buf; int blen, bsiz; @@ -276,7 +284,8 @@ rb_f_sprintf(argc, argv) rb_raise(rb_eArgError, "flag after precision"); \ } - fmt = GETNTHARG(0); + ++argc; + --argv; if (OBJ_TAINTED(fmt)) tainted = 1; StringValue(fmt); fmt = rb_str_new4(fmt); |