kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

merge revision(s) d5c33364e3: [Backport #16105]

Browse source 
Fixed heap-use-after-free

	* string.c (rb_str_sub_bang): retrieves a pointer to the
	  replacement string buffer just before using it, for the case of
	  replacement with the receiver string itself.  [Bug #16105]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67747 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nagachika 2019-08-18 07:22:19 +00:00
parent 1ea42115af
commit a2da0c2a4d
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
string.c
View file

@ -5078,7 +5078,7 @@ rb_str_sub_bang(int argc, VALUE *argv, VALUE str)
cr = cr2; cr = cr2;
} }
plen = end0 - beg0; plen = end0 - beg0;
rp = RSTRING_PTR(repl); rlen = RSTRING_LEN(repl); rlen = RSTRING_LEN(repl);
len = RSTRING_LEN(str); len = RSTRING_LEN(str);
if (rlen > plen) { if (rlen > plen) {
RESIZE_CAPA(str, len + rlen - plen); RESIZE_CAPA(str, len + rlen - plen);
@ -5087,6 +5087,7 @@ rb_str_sub_bang(int argc, VALUE *argv, VALUE str)
if (rlen != plen) { if (rlen != plen) {
memmove(p + beg0 + rlen, p + beg0 + plen, len - beg0 - plen); memmove(p + beg0 + rlen, p + beg0 + plen, len - beg0 - plen);
} }
rp = RSTRING_PTR(repl);
memmove(p + beg0, rp, rlen); memmove(p + beg0, rp, rlen);
len += rlen - plen; len += rlen - plen;
STR_SET_LEN(str, len); STR_SET_LEN(str, len);

6
test/ruby/test_string.rb
View file

@ -2008,6 +2008,12 @@ CODE
r.taint r.taint
a.sub!(/./, r) a.sub!(/./, r)
assert_predicate(a, :tainted?) assert_predicate(a, :tainted?)
bug16105 = '[Bug #16105] heap-use-after-free'
a = S("ABCDEFGHIJKLMNOPQRSTUVWXYZ012345678")
b = a.dup
c = a.slice(1, 100)
assert_equal("AABCDEFGHIJKLMNOPQRSTUVWXYZ012345678", b.sub!(c, b), bug16105)
end end
def test_succ def test_succ

2
version.h
View file

@ -1,6 +1,6 @@
#define RUBY_VERSION "2.6.3" #define RUBY_VERSION "2.6.3"
#define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR #define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR
#define RUBY_PATCHLEVEL 97 #define RUBY_PATCHLEVEL 98
#define RUBY_RELEASE_YEAR 2019 #define RUBY_RELEASE_YEAR 2019
#define RUBY_RELEASE_MONTH 8 #define RUBY_RELEASE_MONTH 8