diff options
author | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2019-08-15 23:25:37 +0900 |
---|---|---|
committer | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2019-08-15 23:39:14 +0900 |
commit | d5c33364e3c0efb15e11df417c925afee2cdb9c9 (patch) | |
tree | 0a279f68525a5f8ac581d8b72a693067dbd40065 /string.c | |
parent | c4152b11a7fbc849a545b34e5b9d85f1fdc1a21f (diff) |
Fixed heap-use-after-free
* string.c (rb_str_sub_bang): retrieves a pointer to the
replacement string buffer just before using it, for the case of
replacement with the receiver string itself. [Bug #16105]
Diffstat (limited to 'string.c')
-rw-r--r-- | string.c | 3 |
1 files changed, 2 insertions, 1 deletions
@@ -5098,7 +5098,7 @@ rb_str_sub_bang(int argc, VALUE *argv, VALUE str) cr = cr2; } plen = end0 - beg0; - rp = RSTRING_PTR(repl); rlen = RSTRING_LEN(repl); + rlen = RSTRING_LEN(repl); len = RSTRING_LEN(str); if (rlen > plen) { RESIZE_CAPA(str, len + rlen - plen); @@ -5107,6 +5107,7 @@ rb_str_sub_bang(int argc, VALUE *argv, VALUE str) if (rlen != plen) { memmove(p + beg0 + rlen, p + beg0 + plen, len - beg0 - plen); } + rp = RSTRING_PTR(repl); memmove(p + beg0, rp, rlen); len += rlen - plen; STR_SET_LEN(str, len); |