https://git.ruby-lang.org/ruby.git/commit/?id=bac99c5175

From bac99c5175bf58815846f9987093a6d944d07fd3 Mon Sep 17 00:00:00 2001
From: nagachika <nagachika@r...>
Date: Sat, 12 Mar 2022 16:36:40 +0900
Subject: merge revision(s) bcc2bb28b04054106f4a36e8fd69b2af6ecb033a: [Backport
 #18500]

	Fix stack buffer overflow

	https://hackerone.com/reports/1306859
	---
	 include/ruby/internal/memory.h | 6 +++---
	 random.c                       | 7 ++-----
	 2 files changed, 5 insertions(+), 8 deletions(-)
---
 include/ruby/internal/memory.h | 6 +++---
 random.c                       | 7 ++-----
 version.h                      | 2 +-
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/include/ruby/internal/memory.h b/include/ruby/internal/memory.h
index 7d24df4945..64f3101fc2 100644
--- a/include/ruby/internal/memory.h
+++ b/include/ruby/internal/memory.h
@@ -110,18 +110,18 @@ extern void *alloca(); https://github.com/ruby/ruby/blob/trunk/include/ruby/internal/memory.h#L110
     ((var) = RBIMPL_CAST((type *)ruby_xrealloc2((void *)(var), (n), sizeof(type))))
 
 #define ALLOCA_N(type,n) \
-    RBIMPL_CAST((type *)alloca(rbimpl_size_mul_or_raise(sizeof(type), (n))))
+    RBIMPL_CAST((type *)(!(n) ? NULL : alloca(rbimpl_size_mul_or_raise(sizeof(type), (n)))))
 
 /* allocates _n_ bytes temporary buffer and stores VALUE including it
  * in _v_.  _n_ may be evaluated twice. */
 #define RB_ALLOCV(v, n)        \
     ((n) < RUBY_ALLOCV_LIMIT ? \
-     ((v) = 0, alloca(n)) :    \
+     ((v) = 0, !(n) ? NULL : alloca(n)) : \
      rb_alloc_tmp_buffer(&(v), (n)))
 #define RB_ALLOCV_N(type, v, n)                             \
     RBIMPL_CAST((type *)                                     \
         (((size_t)(n) < RUBY_ALLOCV_LIMIT / sizeof(type)) ? \
-         ((v) = 0, alloca((n) * sizeof(type))) :            \
+         ((v) = 0, !(n) ? NULL : alloca((n) * sizeof(type))) : \
          rb_alloc_tmp_buffer2(&(v), (n), sizeof(type))))
 #define RB_ALLOCV_END(v) rb_free_tmp_buffer(&(v))
 
diff --git a/random.c b/random.c
index 7567d13dd7..4d70c17116 100644
--- a/random.c
+++ b/random.c
@@ -369,15 +369,12 @@ rand_init(const rb_random_interface_t *rng, rb_random_t *rnd, VALUE seed) https://github.com/ruby/ruby/blob/trunk/random.c#L369
     int sign;
 
     len = rb_absint_numwords(seed, 32, NULL);
+    if (len == 0) len = 1;
     buf = ALLOCV_N(uint32_t, buf0, len);
     sign = rb_integer_pack(seed, buf, len, sizeof(uint32_t), 0,
         INTEGER_PACK_LSWORD_FIRST|INTEGER_PACK_NATIVE_BYTE_ORDER);
     if (sign < 0)
         sign = -sign;
-    if (len == 0) {
-        buf[0] = 0;
-        len = 1;
-    }
     if (len > 1) {
         if (sign != 2 && buf[len-1] == 1) /* remove leading-zero-guard */
             len--;
@@ -814,7 +811,7 @@ rand_mt_init(rb_random_t *rnd, const uint32_t *buf, size_t len) https://github.com/ruby/ruby/blob/trunk/random.c#L811
 {
     struct MT *mt = &((rb_random_mt_t *)rnd)->mt;
     if (len <= 1) {
-        init_genrand(mt, buf[0]);
+        init_genrand(mt, len ? buf[0] : 0);
     }
     else {
         init_by_array(mt, buf, (int)len);
diff --git a/version.h b/version.h
index aeaeaeb323..4928ce7c03 100644
--- a/version.h
+++ b/version.h
@@ -12,7 +12,7 @@ https://github.com/ruby/ruby/blob/trunk/version.h#L12
 # define RUBY_VERSION_MINOR RUBY_API_VERSION_MINOR
 #define RUBY_VERSION_TEENY 4
 #define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR
-#define RUBY_PATCHLEVEL 187
+#define RUBY_PATCHLEVEL 188
 
 #define RUBY_RELEASE_YEAR 2022
 #define RUBY_RELEASE_MONTH 3
-- 
cgit v1.2.1


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/