kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

merge revision(s) 55054: [Backport #12390]

Browse source 
* string.c (rb_str_modify_expand): check integer overflow.
	  [ruby-core:75592] [Bug #12390]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@55352 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
usa 2016-06-10 06:58:57 +00:00
parent 7a25e90ee5
commit 23bc28e2df
4 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
Fri Jun 10 15:56:24 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
* string.c (rb_str_modify_expand): check integer overflow.
[ruby-core:75592] [Bug #12390]
Fri Jun 10 15:54:05 2016 Benoit Daloze <eregontp@gmail.com>
* insns.def (defineclass): Also raise an error when redeclaring the

3
string.c
View file

@ -1635,6 +1635,9 @@ rb_str_modify_expand(VALUE str, long expand)
long len = RSTRING_LEN(str);
long capa = len + expand;
int termlen = TERM_LEN(str);
if (expand >= LONG_MAX - len - termlen) {
rb_raise(rb_eArgError, "string size too big");
}
if (!STR_EMBED_P(str)) {
REALLOC_N(RSTRING(str)->as.heap.ptr, char, capa + termlen);
RSTRING(str)->as.heap.aux.capa = capa;

9
test/-ext-/string/test_modify_expand.rb
View file

@ -12,4 +12,13 @@ class Test_StringModifyExpand < Test::Unit::TestCase
s.replace("")
CMD
end
def test_integer_overflow
bug12390 = '[ruby-core:75592] [Bug #12390]'
s = Bug::String.new
long_max = (1 << (8 * RbConfig::SIZEOF['long'] - 1)) - 1
assert_raise(ArgumentError, bug12390) {
s.modify_expand!(long_max)
}
end
end

2
version.h
View file

@ -1,6 +1,6 @@
#define RUBY_VERSION "2.2.6"
#define RUBY_RELEASE_DATE "2016-06-10"
#define RUBY_PATCHLEVEL 327
#define RUBY_PATCHLEVEL 328
#define RUBY_RELEASE_YEAR 2016
#define RUBY_RELEASE_MONTH 6