diff options
author | nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-01-06 08:44:17 +0000 |
---|---|---|
committer | nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-01-06 08:44:17 +0000 |
commit | e043ae73488e7fa623632ddbbbe51c70f1bae565 (patch) | |
tree | fc2de898f24c0ca3e86b674180de13ca20ab10a9 /string.c | |
parent | 660740a75dd9526ad9a2732ea87c8ab5a385ef1f (diff) | |
download | ruby-e043ae73488e7fa623632ddbbbe51c70f1bae565.tar.gz |
string.c: out-of-bounds access
* string.c (rb_str_enumerate_lines): fix out-of-bounds access when
record separator is longer than the last element. [Bug #14257]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61636 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'string.c')
-rw-r--r-- | string.c | 3 |
1 files changed, 2 insertions, 1 deletions
@@ -8026,7 +8026,8 @@ rb_str_enumerate_lines(int argc, VALUE *argv, VALUE str, VALUE ary) if (rsnewline) { pend = chomp_newline(subptr, pend, enc); } - else if (memcmp(pend - rslen, rsptr, rslen) == 0) { + else if (pend - subptr >= rslen && + memcmp(pend - rslen, rsptr, rslen) == 0) { pend -= rslen; } } |