Check memory boundary in `mrb_str_len_to_dbl`.

afad9391 · Yukihiro "Matz" Matsumoto · 3e4e10ff · afad9391
Commit afad9391 authored Jan 07, 2020 by Yukihiro "Matz" Matsumoto
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

src/string.c src/string.c +1 -1

No files found.
--- a/src/string.c
+++ b/src/string.c
@@ -2500,7 +2500,7 @@ mrb_str_len_to_dbl(mrb_state *mrb, const char *s, size_t len, mrb_bool badcheck)
  double d;

  if (!p) return 0.0;
-  while (ISSPACE(*p)) p++;
+  while (p<pend && ISSPACE(*p)) p++;

  if (pend - p > 2 && p[0] == '0' && (p[1] == 'x' || p[1] == 'X')) {
    mrb_value x;