diff options
| author | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-01-17 22:08:56 +0000 |
|---|---|---|
| committer | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-01-17 22:08:56 +0000 |
| commit | a5dae936e095be836b7aa88c339d4f1bd5f04a22 (patch) | |
| tree | 92442407c869a3bd75d01bbbaff9797bfe66eee6 /version.h | |
| parent | d79405ff26e79666bd14e72e6e91452c766969f9 (diff) | |
merge revision(s) 66832: [Backport #15536]
st.c (rb_hash_bulk_insert_into_st_table): avoid out-of-bounds write
"hash_bulk_insert" first expands the table, but the target size was
wrong: it was calculated by "num_entries + (size to buld insert)", but
it was wrong when "num_entries < entries_bound", i.e., it has a deleted
entry. "hash_bulk_insert" adds the given entries from entries_bound,
which led to out-of-bounds write access. [Bug #15536]
As a simple fix, this commit changes the calculation to "entries_bound +
size". I'm afraid if this might be inefficient, but I think it is safe
anyway.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@66853 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'version.h')
| -rw-r--r-- | version.h | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -1,6 +1,6 @@ #define RUBY_VERSION "2.6.0" #define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR -#define RUBY_PATCHLEVEL 21 +#define RUBY_PATCHLEVEL 22 #define RUBY_RELEASE_YEAR 2019 #define RUBY_RELEASE_MONTH 1 |