summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog6
-rw-r--r--ext/date/date_strftime.c9
-rw-r--r--test/date/test_date_strftime.rb8
3 files changed, 21 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index 05fb3d5..fa058d2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Tue Jun 14 22:07:25 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
+
+ * ext/date/date_strftime.c (date_strftime_with_tmx): reject too
+ large precision to get rid of buffer overflow.
+ reported by Guido Vranken <guido AT guidovranken.nl>.
+
Tue Jun 14 21:40:42 2016 Kazuki Yamaguchi <k@rhe.jp>
* ext/openssl/ossl_ocsp.c (ossl_ocspbres_to_der, ossl_ocspcid_to_der):
diff --git a/ext/date/date_strftime.c b/ext/date/date_strftime.c
index 20931a3..9d8167b 100644
--- a/ext/date/date_strftime.c
+++ b/ext/date/date_strftime.c
@@ -48,7 +48,7 @@ downcase(char *s, size_t i)
/* strftime --- produce formatted time */
static size_t
-date_strftime_with_tmx(char *s, size_t maxsize, const char *format,
+date_strftime_with_tmx(char *s, const size_t maxsize, const char *format,
const struct tmx *tmx)
{
char *endp = s + maxsize;
@@ -575,7 +575,12 @@ date_strftime_with_tmx(char *s, size_t maxsize, const char *format,
case '5': case '6': case '7': case '8': case '9':
{
char *e;
- precision = (int)strtoul(format, &e, 10);
+ unsigned long prec = strtoul(format, &e, 10);
+ if (prec > INT_MAX || prec > maxsize) {
+ errno = ERANGE;
+ return 0;
+ }
+ precision = (int)prec;
format = e - 1;
goto again;
}
diff --git a/test/date/test_date_strftime.rb b/test/date/test_date_strftime.rb
index 7472a43..1c0f9b1 100644
--- a/test/date/test_date_strftime.rb
+++ b/test/date/test_date_strftime.rb
@@ -420,4 +420,12 @@ class TestDateStrftime < Test::Unit::TestCase
end
+ def test_overflow
+ assert_raise(ArgumentError, Errno::ERANGE) {
+ Date.new(2000,1,1).strftime("%2147483647c")
+ }
+ assert_raise(ArgumentError, Errno::ERANGE) {
+ DateTime.new(2000,1,1).strftime("%2147483647c")
+ }
+ end
end