From bcc2bb28b04054106f4a36e8fd69b2af6ecb033a Mon Sep 17 00:00:00 2001 From: Nobuyoshi Nakada Date: Tue, 17 Aug 2021 22:01:57 +0900 Subject: Fix stack buffer overflow https://hackerone.com/reports/1306859 --- include/ruby/internal/memory.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/ruby/internal/memory.h b/include/ruby/internal/memory.h index aa3464465d..242892d50f 100644 --- a/include/ruby/internal/memory.h +++ b/include/ruby/internal/memory.h @@ -284,7 +284,7 @@ typedef uint128_t DSIZE_T; * @return A pointer on stack. */ #define ALLOCA_N(type,n) \ - RBIMPL_CAST((type *)alloca(rbimpl_size_mul_or_raise(sizeof(type), (n)))) + RBIMPL_CAST((type *)(!(n) ? NULL : alloca(rbimpl_size_mul_or_raise(sizeof(type), (n))))) /** * Identical to #RB_ALLOCV_N(), except it implicitly assumes the type of array @@ -297,7 +297,7 @@ typedef uint128_t DSIZE_T; */ #define RB_ALLOCV(v, n) \ ((n) < RUBY_ALLOCV_LIMIT ? \ - ((v) = 0, alloca(n)) : \ + ((v) = 0, !(n) ? NULL : alloca(n)) : \ rb_alloc_tmp_buffer(&(v), (n))) /** @@ -330,7 +330,7 @@ typedef uint128_t DSIZE_T; #define RB_ALLOCV_N(type, v, n) \ RBIMPL_CAST((type *) \ (((size_t)(n) < RUBY_ALLOCV_LIMIT / sizeof(type)) ? \ - ((v) = 0, alloca((n) * sizeof(type))) : \ + ((v) = 0, !(n) ? NULL : alloca((n) * sizeof(type))) : \ rb_alloc_tmp_buffer2(&(v), (n), sizeof(type)))) /** -- cgit v1.2.3