* sprintf.c (rb_f_sprintf): [ruby-dev:27967]

* sprintf.c (rb_str_format): integer overflow check added.

* sprintf.c (GETASTER): ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@9655 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 5 insertions, 3 deletions

diff --git a/sprintf.c b/sprintf.c
index eddb7c33ca..9746d189e1 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -113,10 +113,11 @@ sign_bits(base, p)
     t = p++; \
     n = 0; \
     for (; p < end && ISDIGIT(*p); p++) { \
-	if ((n*10) / 10 != n) { \
+	int next_n = 10 * n + (*p - '0'); \
+        if (next_n / 10 != n) {\
 	    rb_raise(rb_eArgError, #val " too big"); \
 	} \
-	n = 10 * n + (*p - '0'); \
+	n = next_n; \
     } \
     if (p >= end) { \
 	rb_raise(rb_eArgError, "malformed format string - %%*[0-9]"); \
@@ -312,7 +313,8 @@ rb_f_sprintf(argc, argv)
 	  case '5': case '6': case '7': case '8': case '9':
 	    n = 0;
 	    for (; p < end && ISDIGIT(*p); p++) {
-		if ((n*10) / 10 != n) {
+		int next_n = 10 * n + (*p - '0');
+		if (next_n / 10 != n) {
 		    rb_raise(rb_eArgError, "width too big");
 		}
 		n = 10 * n + (*p - '0');