From 594a34bedacc74101e511e5861742cab0694c54e Mon Sep 17 00:00:00 2001 From: shyouhei Date: Thu, 19 Jun 2008 23:12:46 +0000 Subject: * array.c (ary_new, rb_ary_initialize, rb_ary_store, rb_ary_aplice, rb_ary_times): integer overflows should be checked. based on patches from Drew Yao fixed CVE-2008-2726 * string.c (rb_str_buf_append): fixed unsafe use of alloca, which led memory corruption. based on a patch from Drew Yao fixed CVE-2008-2726 * sprintf.c (rb_str_format): backported from trunk. * intern.h: ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_7@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- string.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) (limited to 'string.c') diff --git a/string.c b/string.c index 5f1414ac34..fab5d0bcf3 100644 --- a/string.c +++ b/string.c @@ -459,22 +459,15 @@ rb_str_times(str, times) */ static VALUE -rb_str_format(str, arg) +rb_str_format_m(str, arg) VALUE str, arg; { - VALUE *argv; + VALUE tmp = rb_check_array_type(arg); - if (TYPE(arg) == T_ARRAY) { - argv = ALLOCA_N(VALUE, RARRAY(arg)->len + 1); - argv[0] = str; - MEMCPY(argv+1, RARRAY(arg)->ptr, VALUE, RARRAY(arg)->len); - return rb_f_sprintf(RARRAY(arg)->len+1, argv); + if (!NIL_P(tmp)) { + return rb_str_format(RARRAY_LEN(tmp), RARRAY_PTR(tmp), str); } - - argv = ALLOCA_N(VALUE, 2); - argv[0] = str; - argv[1] = arg; - return rb_f_sprintf(2, argv); + return rb_str_format(1, &arg, str); } static int @@ -795,6 +788,9 @@ rb_str_buf_append(str, str2) capa = RSTRING(str)->aux.capa; } len = RSTRING(str)->len+RSTRING(str2)->len; + if (len < 0 || (capa+1) > LONG_MAX / 2) { + rb_raise(rb_eArgError, "string sizes too big"); + } if (capa <= len) { while (len > capa) { capa = (capa + 1) * 2; @@ -4923,7 +4919,7 @@ Init_String() rb_define_method(rb_cString, "casecmp", rb_str_casecmp, 1); rb_define_method(rb_cString, "+", rb_str_plus, 1); rb_define_method(rb_cString, "*", rb_str_times, 1); - rb_define_method(rb_cString, "%", rb_str_format, 1); + rb_define_method(rb_cString, "%", rb_str_format_m, 1); rb_define_method(rb_cString, "[]", rb_str_aref_m, -1); rb_define_method(rb_cString, "[]=", rb_str_aset_m, -1); rb_define_method(rb_cString, "insert", rb_str_insert, 2); -- cgit v1.2.3