akr	2013-04-10 06:37:04 +0900 (Wed, 10 Apr 2013)

  New Revision: 40209

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=40209

  Log:
    * internal.h (MUL_OVERFLOW_INT_P): New macro.
    
    * sprintf.c (GETNUM): Don't overflow on signed integer multiplication.

  Modified files:
    trunk/ChangeLog
    trunk/internal.h
    trunk/sprintf.c

Index: ChangeLog
===================================================================
--- ChangeLog	(revision 40208)
+++ ChangeLog	(revision 40209)
@@ -1,3 +1,9 @@ https://github.com/ruby/ruby/blob/trunk/ChangeLog#L1
+Wed Apr 10 06:32:12 2013  Tanaka Akira  <akr@f...>
+
+	* internal.h (MUL_OVERFLOW_INT_P): New macro.
+
+	* sprintf.c (GETNUM): Don't overflow on signed integer multiplication.
+
 Tue Apr  9 20:38:20 2013  Tanaka Akira  <akr@f...>
 
 	* internal.h (MUL_OVERFLOW_SIGNED_INTEGER_P): New macro.
Index: sprintf.c
===================================================================
--- sprintf.c	(revision 40208)
+++ sprintf.c	(revision 40209)
@@ -14,6 +14,7 @@ https://github.com/ruby/ruby/blob/trunk/sprintf.c#L14
 #include "ruby/ruby.h"
 #include "ruby/re.h"
 #include "ruby/encoding.h"
+#include "internal.h"
 #include <math.h>
 #include <stdarg.h>
 
@@ -128,10 +129,13 @@ sign_bits(int base, const char *p) https://github.com/ruby/ruby/blob/trunk/sprintf.c#L129
 
 #define GETNUM(n, val) \
     for (; p < end && rb_enc_isdigit(*p, enc); p++) {	\
-	int next_n = 10 * (n) + (*p - '0'); \
-        if (next_n / 10 != (n)) {\
+	int next_n = (n); \
+        if (MUL_OVERFLOW_INT_P(10, next_n)) \
 	    rb_raise(rb_eArgError, #val " too big"); \
-	} \
+	next_n *= 10; \
+        if (INT_MAX - (*p - '0') < next_n) \
+	    rb_raise(rb_eArgError, #val " too big"); \
+	next_n += *p - '0'; \
 	(n) = next_n; \
     } \
     if (p >= end) { \
Index: internal.h
===================================================================
--- internal.h	(revision 40208)
+++ internal.h	(revision 40209)
@@ -36,6 +36,7 @@ extern "C" { https://github.com/ruby/ruby/blob/trunk/internal.h#L36
       ((b) > 0 ? (min) / (a) < (b) : (max) / (a) > (b)))
 #define MUL_OVERFLOW_FIXNUM_P(a, b) MUL_OVERFLOW_SIGNED_INTEGER_P(a, b, FIXNUM_MIN, FIXNUM_MAX)
 #define MUL_OVERFLOW_LONG_P(a, b) MUL_OVERFLOW_SIGNED_INTEGER_P(a, b, LONG_MIN, LONG_MAX)
+#define MUL_OVERFLOW_INT_P(a, b) MUL_OVERFLOW_SIGNED_INTEGER_P(a, b, INT_MIN, INT_MAX)
 
 struct rb_deprecated_classext_struct {
     char conflict[sizeof(VALUE) * 3];

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/