kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

* array.c (rb_ary_subseq): need integer overflow check.

Browse source 
[ruby-dev:31736]

* array.c (rb_ary_splice): ditto.  [ruby-dev:31737]

* array.c (rb_ary_fill): ditto.  [ruby-dev:31738]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@13346 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
matz 2007-09-05 13:37:18 +00:00
parent c349959778
commit 9df2b5fd0c
2 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ChangeLog
View file

@ -1,5 +1,12 @@
Wed Sep 5 22:02:27 2007 Yukihiro Matsumoto <matz@ruby-lang.org> Wed Sep 5 22:02:27 2007 Yukihiro Matsumoto <matz@ruby-lang.org>
* array.c (rb_ary_subseq): need integer overflow check.
[ruby-dev:31736]
* array.c (rb_ary_splice): ditto. [ruby-dev:31737]
* array.c (rb_ary_fill): ditto. [ruby-dev:31738]
* string.c (rb_str_splice): integer overflow for length. * string.c (rb_str_splice): integer overflow for length.
[ruby-dev:31739] [ruby-dev:31739]

11
array.c
View file

@ -683,10 +683,8 @@ rb_ary_subseq(VALUE ary, long beg, long len)
if (beg > RARRAY_LEN(ary)) return Qnil; if (beg > RARRAY_LEN(ary)) return Qnil;
if (beg < 0 || len < 0) return Qnil; if (beg < 0 || len < 0) return Qnil;
if (beg + len > RARRAY_LEN(ary)) { if (RARRAY_LEN(ary) < len || RARRAY_LEN(ary) < beg + len) {
len = RARRAY_LEN(ary) - beg; len = RARRAY_LEN(ary) - beg;
if (len < 0)
len = 0;
} }
klass = rb_obj_class(ary); klass = rb_obj_class(ary);
if (len == 0) return ary_new(klass, 0); if (len == 0) return ary_new(klass, 0);
@ -994,7 +992,7 @@ rb_ary_splice(VALUE ary, long beg, long len, VALUE rpl)
rb_raise(rb_eIndexError, "index %ld out of array", beg); rb_raise(rb_eIndexError, "index %ld out of array", beg);
} }
} }
if (beg + len > RARRAY_LEN(ary)) { if (RARRAY_LEN(ary) < len || RARRAY_LEN(ary) < beg + len) {
len = RARRAY_LEN(ary) - beg; len = RARRAY_LEN(ary) - beg;
} }
@ -2140,7 +2138,10 @@ rb_ary_fill(int argc, VALUE *argv, VALUE ary)
rb_ary_modify(ary); rb_ary_modify(ary);
ary_iter_check(ary); ary_iter_check(ary);
end = beg + len; end = beg + len;
if (end > RARRAY_LEN(ary)) { if (end < 0) {
rb_raise(rb_eArgError, "argument too big");
}
if (RARRAY_LEN(ary) < end) {
if (end >= ARY_CAPA(ary)) { if (end >= ARY_CAPA(ary)) {
RESIZE_CAPA(ary, end); RESIZE_CAPA(ary, end);
} }