Check negative `count` in `pack_x` and `unpack_x`; fix #3944

parent 4f31bcbc
...@@ -833,9 +833,10 @@ pack_x(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, long count, u ...@@ -833,9 +833,10 @@ pack_x(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, long count, u
{ {
long i; long i;
if (count < 0) return 0;
dst = str_len_ensure(mrb, dst, didx + count); dst = str_len_ensure(mrb, dst, didx + count);
for (i = 0; i < count; i++) { for (i = didx; i < count; i++) {
RSTRING_PTR(dst)[didx] = '\0'; RSTRING_PTR(dst)[i] = '\0';
} }
return count; return count;
} }
...@@ -843,6 +844,7 @@ pack_x(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, long count, u ...@@ -843,6 +844,7 @@ pack_x(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, long count, u
static int static int
unpack_x(mrb_state *mrb, const void *src, int slen, mrb_value ary, int count, unsigned int flags) unpack_x(mrb_state *mrb, const void *src, int slen, mrb_value ary, int count, unsigned int flags)
{ {
if (count < 0) return slen;
if (slen < count) { if (slen < count) {
mrb_raise(mrb, E_ARGUMENT_ERROR, "x outside of string"); mrb_raise(mrb, E_ARGUMENT_ERROR, "x outside of string");
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment