Skip to content
Browse files

Properly fix the int overflow bug reported by Ian

--HG--
extra : convert_revision : 0748b2807e5ea77269050ae6c744df455988a808
  • Loading branch information...
1 parent 26eab0f commit 98252859097c1323d17ffa4bdb14380b05d1fd8c @bos committed Oct 4, 2010
Showing with 17 additions and 3 deletions.
  1. +2 −0 Data/Text.hs
  2. +1 −1 Data/Text/Array.hs
  3. +13 −1 tests/Regressions.hs
  4. +1 −1 text.cabal
View
2 Data/Text.hs
@@ -807,6 +807,8 @@ replicate n t@(Text a o l)
| n <= 0 || l <= 0 = empty
| n == 1 = t
| isSingleton t = replicateChar n (unsafeHead t)
+ | len < n = error $ "Data.Text.replicate: invalid length " ++
+ show n -- multiplication overflow
| otherwise = Text (A.run x) 0 len
where
len = l * n
View
2 Data/Text/Array.hs
@@ -103,7 +103,7 @@ instance IArray (MArray s) where
-- | Create an uninitialized mutable array.
new :: forall s. Int -> ST s (MArray s)
new n
- | len < 0 = error $ "Data.Text.Array.unsafeNew: invalid length " ++ show n
+ | len < n = error $ "Data.Text.Array.unsafeNew: invalid length " ++ show n
| otherwise = ST $ \s1# ->
case newByteArray# len# s1# of
(# s2#, marr# #) -> (# s2#, MArray marr#
View
14 tests/Regressions.hs
@@ -1,11 +1,12 @@
-{-# LANGUAGE ScopedTypeVariables #-}
+{-# LANGUAGE OverloadedStrings, ScopedTypeVariables #-}
-- Regression tests for specific bugs.
import Control.Exception (SomeException, handle)
import System.IO
import qualified Data.ByteString as B
import qualified Data.ByteString.Lazy as LB
+import qualified Data.Text as T
import qualified Data.Text.IO as T
import qualified Data.Text.Lazy as LT
import qualified Data.Text.Lazy.Encoding as LE
@@ -30,10 +31,21 @@ hGetContents_crash = withTempFile $ \ path h -> do
handle (\(_::SomeException) -> return ()) $
T.hGetContents h' >> assertFailure "T.hGetContents should crash"
+-- Reported by Ian Lynagh: attempting to allocate a sufficiently large
+-- string (via either Array.new or Text.replicate) could result in an
+-- integer overflow.
+replicate_crash = handle (\(_::SomeException) -> return ()) $
+ T.replicate (2^power) "0123456789abcdef" `seq`
+ assertFailure "T.replicate should crash"
+ where
+ power | maxBound == (2147483647::Int) = 28
+ | otherwise = 60 :: Int
+
tests :: F.Test
tests = F.testGroup "crashers" [
F.testCase "hGetContents_crash" hGetContents_crash
, F.testCase "lazy_encode_crash" lazy_encode_crash
+ , F.testCase "replicate_crash" replicate_crash
]
main = F.defaultMain [tests]
View
2 text.cabal
@@ -1,5 +1,5 @@
name: text
-version: 0.9.0.2
+version: 0.9.0.1
homepage: http://code.haskell.org/text
synopsis: An efficient packed Unicode text type.
description:

0 comments on commit 9825285

Please sign in to comment.
Something went wrong with that request. Please try again.