pack.c: fixed a overwriting bug in `pack_w` and `pack_M`.

parent ad194bd4
...@@ -398,7 +398,7 @@ pack_w(mrb_state *mrb, mrb_value o, mrb_value str, mrb_int sidx, unsigned int fl ...@@ -398,7 +398,7 @@ pack_w(mrb_state *mrb, mrb_value o, mrb_value str, mrb_int sidx, unsigned int fl
if ((n & mask) == 0) break; if ((n & mask) == 0) break;
} }
str = str_len_ensure(mrb, str, sidx + i); str = str_len_ensure(mrb, str, sidx + i);
p = RSTRING_PTR(str); p = RSTRING_PTR(str)+sidx;
for (size_t j=i; j>0; p++,j--) { for (size_t j=i; j>0; p++,j--) {
mrb_int x = (n>>(7*(j-1)))&0x7f; mrb_int x = (n>>(7*(j-1)))&0x7f;
*p = (char)x; *p = (char)x;
...@@ -997,8 +997,8 @@ pack_M(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, int count) ...@@ -997,8 +997,8 @@ pack_M(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, int count)
prev = '\n'; prev = '\n';
} }
if (i > 1024 - 5) { if (i > 1024 - 5) {
str_len_ensure(mrb, dst, didx+i); str_len_ensure(mrb, dst, didx+dlen+i);
memcpy(RSTRING_PTR(dst), buff, i); memcpy(RSTRING_PTR(dst)+didx+dlen, buff, i);
dlen += i; dlen += i;
i = 0; i = 0;
} }
...@@ -1009,8 +1009,8 @@ pack_M(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, int count) ...@@ -1009,8 +1009,8 @@ pack_M(mrb_state *mrb, mrb_value src, mrb_value dst, mrb_int didx, int count)
buff[i++] = '\n'; buff[i++] = '\n';
} }
if (i > 0) { if (i > 0) {
str_len_ensure(mrb, dst, didx+i); str_len_ensure(mrb, dst, didx+dlen+i);
memcpy(RSTRING_PTR(dst), buff, i); memcpy(RSTRING_PTR(dst)+didx+dlen, buff, i);
dlen += i; dlen += i;
} }
return dlen; return dlen;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment