Attachment 309654 Details for Bug 450821 – Upstream patch against 1.9

[patch] Upstream patch against 1.9

ruby-multiple-overflows-1.9.patch (text/plain), 2.30 KB, created by Tomas Hoger on 2008-06-17 18:28:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-06-17 18:28:45 UTC

Size: 2.30 KB

patch

obsolete

>Patches to 1.9:
>Index: trunk/array.c
>===================================================================
>--- trunk/array.c	(revision 16850)
>+++ trunk/array.c	(working copy)
>@@ -21,4 +21,5 @@ static ID id_cmp;
>
>#define ARY_DEFAULT_SIZE 16
>+#define ARY_MAX_SIZE (LONG_MAX / sizeof(VALUE))
>
>void
>@@ -115,5 +116,5 @@ ary_new(VALUE klass, long len)
>	rb_raise(rb_eArgError, "negative array size (or size too big)");
>     }
>-    if (len > LONG_MAX / sizeof(VALUE)) {
>+    if (len > ARY_MAX_SIZE) {
>	rb_raise(rb_eArgError, "array size too big");
>     }
>@@ -314,5 +315,5 @@ rb_ary_initialize(int argc, VALUE *argv,
>	rb_raise(rb_eArgError, "negative array size");
>     }
>-    if (len > LONG_MAX / sizeof(VALUE)) {
>+    if (len > ARY_MAX_SIZE) {
>	rb_raise(rb_eArgError, "array size too big");
>     }
>@@ -372,4 +373,7 @@ rb_ary_store(VALUE ary, long idx, VALUE
>	}
>     }
>+    else if (idx >= ARY_MAX_SIZE) {
>+	rb_raise(rb_eIndexError, "index %ld too big", idx);
>+    }
>
>     rb_ary_modify(ary);
>@@ -380,11 +384,8 @@ rb_ary_store(VALUE ary, long idx, VALUE
>	    new_capa = ARY_DEFAULT_SIZE;
>	}
>-	if (new_capa + idx < new_capa) {
>-	    rb_raise(rb_eArgError, "index too big");
>+	else if (new_capa >= ARY_MAX_SIZE - idx) {
>+	    new_capa = (ARY_MAX_SIZE - idx) / 2;
>	}
>	new_capa += idx;
>-	if (new_capa * (long)sizeof(VALUE) <= new_capa) {
>-	    rb_raise(rb_eArgError, "index too big");
>-	}
>	RESIZE_CAPA(ary, new_capa);
>     }
>@@ -987,4 +988,7 @@ rb_ary_splice(VALUE ary, long beg, long
>     if (beg >= RARRAY_LEN(ary)) {
>	len = beg + rlen;
>+	if (len < 0 || len > ARY_MAX_SIZE) {
>+	    rb_raise(rb_eIndexError, "index %ld too big", beg);
>+	}
>	if (len >= ARY_CAPA(ary)) {
>	    RESIZE_CAPA(ary, len);
>@@ -2254,5 +2258,5 @@ rb_ary_times(VALUE ary, VALUE times)
>	rb_raise(rb_eArgError, "negative argument");
>     }
>-    if (LONG_MAX/len < RARRAY_LEN(ary)) {
>+    if (ARY_MAX_SIZE/len < RARRAY_LEN(ary)) {
>	rb_raise(rb_eArgError, "argument too big");
>     }
>Index: trunk/string.c
>===================================================================
>--- trunk/string.c	(revision 16850)
>+++ trunk/string.c	(working copy)
>@@ -1567,4 +1567,7 @@ rb_enc_cr_str_buf_cat(VALUE str, const c
>     }
>     total = RSTRING_LEN(str)+len;
>+    if (total < 0 || capa + 1 > LONG_MAX / 2) {
>+	rb_raise(rb_eArgError, "string sizes too big");
>+    }
>     if (capa <= total) {
>	while (total > capa) {
>
>

Actions: View | Diff

Attachments on bug 450821: 308901 | 308902 | 309653 | 309654 | 309982