Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
M
mruby
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Libraries
mruby
Commits
8252352d
Unverified
Commit
8252352d
authored
3 years ago
by
Yukihiro "Matz" Matsumoto
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
parse.y: fix buffer overflow with tweaked mruby binary.
parent
0cd12c6d
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
12 additions
and
10 deletions
+12
-10
mrbgems/mruby-compiler/core/parse.y
mrbgems/mruby-compiler/core/parse.y
+6
-5
mrbgems/mruby-compiler/core/y.tab.c
mrbgems/mruby-compiler/core/y.tab.c
+6
-5
No files found.
mrbgems/mruby-compiler/core/parse.y
View file @
8252352d
...
...
@@ -6934,11 +6934,12 @@ mrb_load_detect_file_cxt(mrb_state *mrb, FILE *fp, mrbc_context *c)
binsize = bin_to_uint32(leading.h.binary_size);
bin_obj = mrb_str_new(mrb, NULL, binsize);
bin = (uint8_t *)RSTRING_PTR(bin_obj);
memcpy(bin, leading.b, bufsize);
if (binsize > bufsize &&
fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
if (binsize > bufsize) {
memcpy(bin, leading.b, bufsize);
if (fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
}
}
result = mrb_load_irep_buf_cxt(mrb, bin, binsize, c);
...
...
This diff is collapsed.
Click to expand it.
mrbgems/mruby-compiler/core/y.tab.c
View file @
8252352d
...
...
@@ -13161,11 +13161,12 @@ mrb_load_detect_file_cxt(mrb_state *mrb, FILE *fp, mrbc_context *c)
binsize
=
bin_to_uint32
(
leading
.
h
.
binary_size
);
bin_obj
=
mrb_str_new
(
mrb
,
NULL
,
binsize
);
bin
=
(
uint8_t
*
)
RSTRING_PTR
(
bin_obj
);
memcpy
(
bin
,
leading
.
b
,
bufsize
);
if
(
binsize
>
bufsize
&&
fread
(
bin
+
bufsize
,
binsize
-
bufsize
,
1
,
fp
)
==
0
)
{
binsize
=
bufsize
;
/* The error is reported by mrb_load_irep_buf_cxt() */
if
(
binsize
>
bufsize
)
{
memcpy
(
bin
,
leading
.
b
,
bufsize
);
if
(
fread
(
bin
+
bufsize
,
binsize
-
bufsize
,
1
,
fp
)
==
0
)
{
binsize
=
bufsize
;
/* The error is reported by mrb_load_irep_buf_cxt() */
}
}
result
=
mrb_load_irep_buf_cxt
(
mrb
,
bin
,
binsize
,
c
);
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment