nobu	2008-02-26 16:41:34 +0900 (Tue, 26 Feb 2008)

  New Revision: 15614

  Modified files:
    trunk/ChangeLog
    trunk/array.c

  Log:
    * array.c (combi_len, rb_ary_product): check for overflow.
      [ruby-Bugs-18355]


  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/array.c?r1=15614&r2=15613&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ChangeLog?r1=15614&r2=15613&diff_format=u

Index: array.c
===================================================================
--- array.c	(revision 15613)
+++ array.c	(revision 15614)
@@ -3072,7 +3072,11 @@
     if (k < 0) return 0;
     val = 1;
     for (i=1; i <= k; i++,n--) {
+	long m = val;
 	val *= n;
+	if (val < m) {
+	    rb_raise(rb_eRangeError, "too big for combination");
+	}
 	val /= i;
     }
     return val;
@@ -3185,8 +3189,12 @@
 
     /* Compute the length of the result array; return [] if any is empty */
     for (i = 0; i < n; i++) {
-	resultlen *= RARRAY_LEN(arrays[i]);
-	if (resultlen == 0) return rb_ary_new2(0);
+	long k = RARRAY_LEN(arrays[i]), l = resultlen;
+	if (k == 0) return rb_ary_new2(0);
+	resultlen *= k;
+	if (resultlen < k || resultlen < l || resultlen / k != l) {
+	    rb_raise(rb_eRangeError, "too big to product");
+	}
     }
 
     /* Otherwise, allocate and fill in an array of results */
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 15613)
+++ ChangeLog	(revision 15614)
@@ -1,3 +1,8 @@
+Tue Feb 26 16:41:27 2008  Nobuyoshi Nakada  <nobu@r...>
+
+	* array.c (combi_len, rb_ary_product): check for overflow.
+	  [ruby-Bugs-18355]
+
 Tue Feb 26 16:38:10 2008  Nobuyoshi Nakada  <nobu@r...>
 
 	* array.c (recursive_cmp): compare minimal length parts.

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/