ruby-changes:50791
From: usa <ko1@a...>
Date: Wed, 28 Mar 2018 19:37:12 +0900 (JST)
Subject: [ruby-changes:50791] usa:r62997 (ruby_2_3): merge revision(s) 62992:
usa 2018-03-28 19:37:07 +0900 (Wed, 28 Mar 2018) New Revision: 62997 https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=62997 Log: merge revision(s) 62992: pack.c: fix underflow * pack.c (pack_unpack_internal): get rid of underflow. https://hackerone.com/reports/298246 Modified directories: branches/ruby_2_3/ Modified files: branches/ruby_2_3/ChangeLog branches/ruby_2_3/pack.c branches/ruby_2_3/test/ruby/test_pack.rb branches/ruby_2_3/version.h Index: ruby_2_3/ChangeLog =================================================================== --- ruby_2_3/ChangeLog (revision 62996) +++ ruby_2_3/ChangeLog (revision 62997) @@ -1,3 +1,10 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_3/ChangeLog#L1 +Wed Mar 28 19:36:24 2018 Nobuyoshi Nakada <nobu@r...> + + pack.c: fix underflow + + * pack.c (pack_unpack_internal): get rid of underflow. + https://hackerone.com/reports/298246 + Wed Mar 28 19:30:54 2018 Nobuyoshi Nakada <nobu@r...> unixsocket.c: check NUL bytes Index: ruby_2_3/test/ruby/test_pack.rb =================================================================== --- ruby_2_3/test/ruby/test_pack.rb (revision 62996) +++ ruby_2_3/test/ruby/test_pack.rb (revision 62997) @@ -548,6 +548,9 @@ class TestPack < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/ruby_2_3/test/ruby/test_pack.rb#L548 assert_equal([1, 2], "\x01\x00\x00\x02".unpack("C@3C")) assert_equal([nil], "\x00".unpack("@1C")) # is it OK? assert_raise(ArgumentError) { "\x00".unpack("@2C") } + + pos = (1 << [nil].pack("p").bytesize * 8) - 100 # -100 + assert_raise(RangeError) {"0123456789".unpack("@#{pos}C10")} end def test_pack_unpack_percent Index: ruby_2_3/version.h =================================================================== --- ruby_2_3/version.h (revision 62996) +++ ruby_2_3/version.h (revision 62997) @@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_3/version.h#L1 #define RUBY_VERSION "2.3.7" #define RUBY_RELEASE_DATE "2018-03-28" -#define RUBY_PATCHLEVEL 453 +#define RUBY_PATCHLEVEL 454 #define RUBY_RELEASE_YEAR 2018 #define RUBY_RELEASE_MONTH 3 Index: ruby_2_3/pack.c =================================================================== --- ruby_2_3/pack.c (revision 62996) +++ ruby_2_3/pack.c (revision 62997) @@ -1235,7 +1235,7 @@ pack_unpack(VALUE str, VALUE fmt) https://github.com/ruby/ruby/blob/trunk/ruby_2_3/pack.c#L1235 else if (ISDIGIT(*p)) { errno = 0; len = STRTOUL(p, (char**)&p, 10); - if (errno) { + if (len < 0 || errno) { rb_raise(rb_eRangeError, "pack length too big"); } } Index: ruby_2_3 =================================================================== --- ruby_2_3 (revision 62996) +++ ruby_2_3 (revision 62997) Property changes on: ruby_2_3 ___________________________________________________________________ Modified: svn:mergeinfo ## -0,0 +0,1 ## Merged /trunk:r62992 -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/