Attachment 309653 Details for Bug 450821 – Upstream patch against 1.8.6

[patch] Upstream patch against 1.8.6

ruby-multiple-overflows-1.8.6.patch (text/plain), 4.16 KB, created by Tomas Hoger on 2008-06-17 18:25:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-06-17 18:25:47 UTC

Size: 4.16 KB

patch

obsolete

>Patches to 1.8.6:
>Index: array.c
>===================================================================
>--- array.c	(revision 16852)
>+++ array.c	(working copy)
>@@ -21,4 +21,5 @@ static ID id_cmp;
>
>#define ARY_DEFAULT_SIZE 16
>+#define ARY_MAX_SIZE (LONG_MAX / sizeof(VALUE))
>
>void
>@@ -121,5 +122,5 @@ ary_new(klass, len)
>	rb_raise(rb_eArgError, "negative array size (or size too big)");
>     }
>-    if (len > 0 && len * sizeof(VALUE) <= len) {
>+    if (len > ARY_MAX_SIZE) {
>	rb_raise(rb_eArgError, "array size too big");
>     }
>@@ -315,5 +316,5 @@ rb_ary_initialize(argc, argv, ary)
>	rb_raise(rb_eArgError, "negative array size");
>     }
>-    if (len > 0 && len * (long)sizeof(VALUE) <= len) {
>+    if (len > ARY_MAX_SIZE) {
>	rb_raise(rb_eArgError, "array size too big");
>     }
>@@ -380,4 +381,7 @@ rb_ary_store(ary, idx, val)
>	}
>     }
>+    else if (idx >= ARY_MAX_SIZE) {
>+	rb_raise(rb_eIndexError, "index %ld too big", idx);
>+    }
>
>     rb_ary_modify(ary);
>@@ -388,8 +392,8 @@ rb_ary_store(ary, idx, val)
>	    new_capa = ARY_DEFAULT_SIZE;
>	}
>-	new_capa += idx;
>-	if (new_capa * (long)sizeof(VALUE) <= new_capa) {
>-	    rb_raise(rb_eArgError, "index too big");
>+	else if (new_capa >= ARY_MAX_SIZE - idx) {
>+	    new_capa = (ARY_MAX_SIZE - idx) / 2;
>	}
>+	new_capa += idx;
>	REALLOC_N(RARRAY(ary)->ptr, VALUE, new_capa);
>	RARRAY(ary)->aux.capa = new_capa;
>@@ -1092,4 +1096,7 @@ rb_ary_splice(ary, beg, len, rpl)
>     if (beg >= RARRAY(ary)->len) {
>	len = beg + rlen;
>+	if (len < 0 || len > ARY_MAX_SIZE) {
>+	    rb_raise(rb_eIndexError, "index %ld too big", beg);
>+	}
>	if (len >= RARRAY(ary)->aux.capa) {
>	    REALLOC_N(RARRAY(ary)->ptr, VALUE, len);
>@@ -2523,5 +2530,5 @@ rb_ary_times(ary, times)
>	rb_raise(rb_eArgError, "negative argument");
>     }
>-    if (LONG_MAX/len < RARRAY(ary)->len) {
>+    if (ARY_MAX_SIZE/len < RARRAY(ary)->len) {
>	rb_raise(rb_eArgError, "argument too big");
>     }
>Index: intern.h
>===================================================================
>--- intern.h	(revision 16852)
>+++ intern.h	(working copy)
>@@ -419,4 +419,5 @@ void ruby_default_signal _((int));
>/* sprintf.c */
>VALUE rb_f_sprintf _((int, VALUE*));
>+VALUE rb_str_format _((int, VALUE*, VALUE));
>/* string.c */
>VALUE rb_str_new _((const char*, long));
>Index: sprintf.c
>===================================================================
>--- sprintf.c	(revision 16873)
>+++ sprintf.c	(working copy)
>@@ -250,5 +250,13 @@ rb_f_sprintf(argc, argv)
>     VALUE *argv;
>{
>+    return rb_str_format(argc - 1, argv + 1, GETNTHARG(0));
>+}
>+
>+VALUE
>+rb_str_format(argc, argv, fmt)
>+    int argc;
>+    VALUE *argv;
>     VALUE fmt;
>+{
>     const char *p, *end;
>     char *buf;
>@@ -279,5 +287,4 @@ rb_f_sprintf(argc, argv)
>     }
>
>-    fmt = GETNTHARG(0);
>+    ++argc;
>+    --argv;
>     if (OBJ_TAINTED(fmt)) tainted = 1;
>     StringValue(fmt);
>Index: string.c
>===================================================================
>--- string.c	(revision 16852)
>+++ string.c	(working copy)
>@@ -460,20 +460,13 @@ rb_str_times(str, times)
>
>static VALUE
>-rb_str_format(str, arg)
>+rb_str_format_m(str, arg)
>     VALUE str, arg;
>{
>-    VALUE *argv;
>+    VALUE tmp = rb_check_array_type(arg);
>
>-    if (TYPE(arg) == T_ARRAY) {
>-	argv = ALLOCA_N(VALUE, RARRAY(arg)->len + 1);
>-	argv[0] = str;
>-	MEMCPY(argv+1, RARRAY(arg)->ptr, VALUE, RARRAY(arg)->len);
>-	return rb_f_sprintf(RARRAY(arg)->len+1, argv);
>+    if (!NIL_P(tmp)) {
>+	return rb_str_format(RARRAY_LEN(tmp), RARRAY_PTR(tmp), str);
>     }
>-
>-    argv = ALLOCA_N(VALUE, 2);
>-    argv[0] = str;
>-    argv[1] = arg;
>-    return rb_f_sprintf(2, argv);
>+    return rb_str_format(1, &arg, str);
>}
>
>@@ -796,4 +789,7 @@ rb_str_buf_append(str, str2)
>     }
>     len = RSTRING(str)->len+RSTRING(str2)->len;
>+    if (len < 0 || (capa+1) > LONG_MAX / 2) {
>+	rb_raise(rb_eArgError, "string sizes too big");
>+    }
>     if (capa <= len) {
>	while (len > capa) {
>@@ -4924,5 +4920,5 @@ Init_String()
>     rb_define_method(rb_cString, "+", rb_str_plus, 1);
>     rb_define_method(rb_cString, "*", rb_str_times, 1);
>-    rb_define_method(rb_cString, "%", rb_str_format, 1);
>+    rb_define_method(rb_cString, "%", rb_str_format_m, 1);
>     rb_define_method(rb_cString, "[]", rb_str_aref_m, -1);
>     rb_define_method(rb_cString, "[]=", rb_str_aset_m, -1);
>

Actions: View | Diff

Attachments on bug 450821: 308901 | 308902 | 309653 | 309654 | 309982