summaryrefslogtreecommitdiff
path: root/sprintf.c
diff options
context:
space:
mode:
authornobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2017-03-20 01:36:08 (GMT)
committernobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2017-03-20 01:36:08 (GMT)
commit57d6dd5a461202f9824c3d1b8d3e5304aca2d21c (patch)
tree682578e1da180b7f65fc7a4b4549316a85592a88 /sprintf.c
parentf31bb33a3b169a26a1336b497284b59f6808610a (diff)
Avoid integer overflow in sprintf()
merged https://github.com/mruby/mruby/commit/ff03a9a61c62340cff62f8e0fdc1a1e8775b6f17 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58034 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'sprintf.c')
-rw-r--r--sprintf.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/sprintf.c b/sprintf.c
index 0438b5e..9273878 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -55,8 +55,9 @@ sign_bits(int base, const char *p)
#define CHECK(l) do {\
int cr = ENC_CODERANGE(result);\
- while (blen + (l) >= bsiz) {\
+ while ((l) >= bsiz - blen) {\
bsiz*=2;\
+ if (bsiz<0) rb_raise(rb_eArgError, "too big specifier");\
}\
rb_str_resize(result, bsiz);\
ENC_CODERANGE_SET(result, cr);\