nobu	2013-07-10 11:19:47 +0900 (Wed, 10 Jul 2013)

  New Revision: 41879

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=41879

  Log:
    ossl.c: check integer overflow
    
    * ext/openssl/ossl.c (Init_ossl_locks): check integer overflow.
      OPENSSL_malloc() takes int only.

  Modified files:
    trunk/ext/openssl/ossl.c

Index: ext/openssl/ossl.c
===================================================================
--- ext/openssl/ossl.c	(revision 41878)
+++ ext/openssl/ossl.c	(revision 41879)
@@ -480,9 +480,13 @@ static unsigned long ossl_thread_id(void https://github.com/ruby/ruby/blob/trunk/ext/openssl/ossl.c#L480
 static void Init_ossl_locks(void)
 {
     int i;
+    int num_locks = CRYPTO_num_locks();
 
-    ossl_locks = (VALUE*) OPENSSL_malloc(CRYPTO_num_locks() * sizeof(VALUE));
-    for (i = 0; i < CRYPTO_num_locks(); i++) {
+    if ((unsigned)num_locks >= INT_MAX / (int)sizeof(VALUE)) {
+	rb_raise(rb_eRuntimeError, "CRYPTO_num_locks() is too big: %d", num_locks);
+    }
+    ossl_locks = (VALUE*) OPENSSL_malloc(num_locks * (int)sizeof(VALUE));
+    for (i = 0; i < num_locks; i++) {
 	ossl_locks[i] = rb_mutex_new();
 	rb_global_variable(&(ossl_locks[i]));
     }

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/