pack.c: check overflow before reading count.

d518294f · Yukihiro "Matz" Matsumoto · af3e0ddf · d518294f
Unverified Commit d518294f authored Jun 06, 2021 by Yukihiro "Matz" Matsumoto
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

mrbgems/mruby-pack/src/pack.c mrbgems/mruby-pack/src/pack.c +1 -1

No files found.
--- a/mrbgems/mruby-pack/src/pack.c
+++ b/mrbgems/mruby-pack/src/pack.c
@@ -1131,10 +1131,10 @@ alias:
    if (ISDIGIT(ch)) {
      count = ch - '0';
      while (tmpl->idx < tlen && ISDIGIT(tptr[tmpl->idx])) {
-        ch = tptr[tmpl->idx++] - '0';
        if (count+10 > INT_MAX/10) {
          mrb_raise(mrb, E_RUNTIME_ERROR, "too big template length");
        }
+        ch = tptr[tmpl->idx++] - '0';
        count = count * 10 + ch;
      }
      continue;  /* special case */