pack.c: failed to detect overflow when `ch` is zero in `read_tmpl`.

parent f01c29b0
......@@ -1131,8 +1131,8 @@ alias:
if (ISDIGIT(ch)) {
count = ch - '0';
while (tmpl->idx < tlen && ISDIGIT(tptr[tmpl->idx])) {
int ch = tptr[tmpl->idx++] - '0';
if (count+ch > INT_MAX/10) {
ch = tptr[tmpl->idx++] - '0';
if (count+10 > INT_MAX/10) {
mrb_raise(mrb, E_RUNTIME_ERROR, "too big template length");
}
count = count * 10 + ch;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment