From bac99c5175bf58815846f9987093a6d944d07fd3 Mon Sep 17 00:00:00 2001 From: nagachika Date: Sat, 12 Mar 2022 16:36:40 +0900 Subject: merge revision(s) bcc2bb28b04054106f4a36e8fd69b2af6ecb033a: [Backport #18500] Fix stack buffer overflow https://hackerone.com/reports/1306859 --- include/ruby/internal/memory.h | 6 +++--- random.c | 7 ++----- 2 files changed, 5 insertions(+), 8 deletions(-) --- include/ruby/internal/memory.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include/ruby') diff --git a/include/ruby/internal/memory.h b/include/ruby/internal/memory.h index 7d24df4945..64f3101fc2 100644 --- a/include/ruby/internal/memory.h +++ b/include/ruby/internal/memory.h @@ -110,18 +110,18 @@ extern void *alloca(); ((var) = RBIMPL_CAST((type *)ruby_xrealloc2((void *)(var), (n), sizeof(type)))) #define ALLOCA_N(type,n) \ - RBIMPL_CAST((type *)alloca(rbimpl_size_mul_or_raise(sizeof(type), (n)))) + RBIMPL_CAST((type *)(!(n) ? NULL : alloca(rbimpl_size_mul_or_raise(sizeof(type), (n))))) /* allocates _n_ bytes temporary buffer and stores VALUE including it * in _v_. _n_ may be evaluated twice. */ #define RB_ALLOCV(v, n) \ ((n) < RUBY_ALLOCV_LIMIT ? \ - ((v) = 0, alloca(n)) : \ + ((v) = 0, !(n) ? NULL : alloca(n)) : \ rb_alloc_tmp_buffer(&(v), (n))) #define RB_ALLOCV_N(type, v, n) \ RBIMPL_CAST((type *) \ (((size_t)(n) < RUBY_ALLOCV_LIMIT / sizeof(type)) ? \ - ((v) = 0, alloca((n) * sizeof(type))) : \ + ((v) = 0, !(n) ? NULL : alloca((n) * sizeof(type))) : \ rb_alloc_tmp_buffer2(&(v), (n), sizeof(type)))) #define RB_ALLOCV_END(v) rb_free_tmp_buffer(&(v)) -- cgit v1.2.3