kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

sprintf.c: fix buffer overflow

Browse source 
* sprintf.c (rb_str_format): fix buffer overflow, length must be
  greater than precision.  reported by William Bowling <will AT
  wbowling.info>.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54304 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2016-03-27 23:18:52 +00:00
parent d1e2d6a9c5
commit 9ae4c2d590
3 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ChangeLog
View file

@ -1,3 +1,9 @@
Mon Mar 28 08:18:51 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
* sprintf.c (rb_str_format): fix buffer overflow, length must be
greater than precision. reported by William Bowling <will AT
wbowling.info>.
Sun Mar 27 12:13:37 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
* sprintf.c (rb_str_format): convert Rational to floating point

2
sprintf.c
View file

@ -1070,7 +1070,7 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
}
val = rb_int2str(num, 10);
len = RSTRING_LEN(val) + zero;
if (prec >= len) ++len; /* integer part 0 */
if (prec >= len) len = prec + 1; /* integer part 0 */
if (sign || (flags&FSPACE)) ++len;
if (prec > 0) ++len; /* period */
CHECK(len > width ? len : width);

4
test/ruby/test_sprintf.rb
View file

@ -177,6 +177,10 @@ class TestSprintf < Test::Unit::TestCase
assert_equal("x"*10+" 1.0", sprintf("x"*10+"%8.1f", 1r), bug11766)
end
def test_rational_precision
assert_match(/\A0\.\d{600}\z/, sprintf("%.600f", 600**~60))
end
def test_hash
options = {:capture=>/\d+/}
assert_equal("with options {:capture=>/\\d+/}", sprintf("with options %p" % options))