nobu	2017-03-20 10:33:08 +0900 (Mon, 20 Mar 2017)

  New Revision: 58033

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=58033

  Log:
    sprintf.c: string limits
    
    * sprintf.c (ruby__sfvwrite): use long instead of size_t due to
      string limits.

  Modified files:
    trunk/sprintf.c
Index: sprintf.c
===================================================================
--- sprintf.c	(revision 58032)
+++ sprintf.c	(revision 58033)
@@ -1301,14 +1301,19 @@ ruby__sfvwrite(register rb_printf_buffer https://github.com/ruby/ruby/blob/trunk/sprintf.c#L1301
     struct __siov *iov;
     VALUE result = (VALUE)fp->_bf._base;
     char *buf = (char*)fp->_p;
-    size_t len, n;
-    size_t blen = buf - RSTRING_PTR(result), bsiz = fp->_w;
+    long len, n;
+    long blen = buf - RSTRING_PTR(result), bsiz = fp->_w;
 
     if (RBASIC(result)->klass) {
 	rb_raise(rb_eRuntimeError, "rb_vsprintf reentered");
     }
-    if ((len = uio->uio_resid) == 0)
+    if (uio->uio_resid == 0)
 	return 0;
+#if SIZE_MAX > LONG_MAX
+    if (uio->uio_resid >= LONG_MAX)
+	rb_raise(rb_eRuntimeError, "too big string");
+#endif
+    len = (long)uio->uio_resid;
     CHECK(len);
     buf += blen;
     fp->_w = bsiz;

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/