* array.c (ary_new, rb_ary_initialize, rb_ary_store,

  rb_ary_aplice, rb_ary_times): integer overflows should be
  checked. based on patches from Drew Yao <ayao at apple.com>
  fixed CVE-2008-2726

* string.c (rb_str_buf_append): fixed unsafe use of alloca,
  which led memory corruption. based on a patch from Drew Yao
  <ayao at apple.com> fixed CVE-2008-2726

* sprintf.c (rb_str_format): backported from trunk.

* intern.h: ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 3 insertions, 0 deletions

diff --git a/string.c b/string.c
index b962880d43..c19544deac 100644
--- a/string.c
+++ b/string.c
@@ -1562,6 +1562,9 @@ rb_enc_cr_str_buf_cat(VALUE str, const char *ptr, long len,
 	capa = RSTRING(str)->as.heap.aux.capa;
     }
     total = RSTRING_LEN(str)+len;
+    if (total < 0 || capa + 1 > LONG_MAX / 2) {
+	rb_raise(rb_eArgError, "string sizes too big");
+    }
     if (capa <= total) {
 	while (total > capa) {
 	    capa = (capa + 1) * 2;