From 8e7393559f9fe73c6ac48deb23217c90a2a35564 Mon Sep 17 00:00:00 2001 From: nobu Date: Mon, 1 Jun 2015 01:55:10 +0000 Subject: tkutil.c: fix out-of-bounds access * ext/tk/tkutil/tkutil.c (cbsubst_table_setup): check array length not access out-of-bounds. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@50708 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ext/tk/tkutil/tkutil.c | 1 + 1 file changed, 1 insertion(+) (limited to 'ext') diff --git a/ext/tk/tkutil/tkutil.c b/ext/tk/tkutil/tkutil.c index 5ef4188e9a..c104bbbd99 100644 --- a/ext/tk/tkutil/tkutil.c +++ b/ext/tk/tkutil/tkutil.c @@ -1617,6 +1617,7 @@ cbsubst_table_setup(argc, argv, self) for(idx = 0; idx < len; idx++) { inf = RARRAY_PTR(proc_inf)[idx]; if (!RB_TYPE_P(inf, T_ARRAY)) continue; + if (RARRAY_LEN(inf) < 2) continue; rb_hash_aset(subst_inf->proc, (RB_TYPE_P(RARRAY_PTR(inf)[0], T_STRING)? INT2FIX(*(RSTRING_PTR(RARRAY_PTR(inf)[0]))) : -- cgit v1.2.3