Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix arbitrary heap exposure problem
  • Loading branch information
flori committed Apr 18, 2017
1 parent c9fc0f0 commit 8f782fd
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 7 deletions.
12 changes: 6 additions & 6 deletions ext/json/ext/generator/generator.c
Expand Up @@ -308,7 +308,7 @@ static char *fstrndup(const char *ptr, unsigned long len) {
char *result;
if (len <= 0) return NULL;
result = ALLOC_N(char, len);
memccpy(result, ptr, 0, len);
memcpy(result, ptr, len);
return result;
}

Expand Down Expand Up @@ -1062,7 +1062,7 @@ static VALUE cState_indent_set(VALUE self, VALUE indent)
}
} else {
if (state->indent) ruby_xfree(state->indent);
state->indent = strdup(RSTRING_PTR(indent));
state->indent = fstrndup(RSTRING_PTR(indent), len);
state->indent_len = len;
}
return Qnil;
Expand Down Expand Up @@ -1100,7 +1100,7 @@ static VALUE cState_space_set(VALUE self, VALUE space)
}
} else {
if (state->space) ruby_xfree(state->space);
state->space = strdup(RSTRING_PTR(space));
state->space = fstrndup(RSTRING_PTR(space), len);
state->space_len = len;
}
return Qnil;
Expand Down Expand Up @@ -1136,7 +1136,7 @@ static VALUE cState_space_before_set(VALUE self, VALUE space_before)
}
} else {
if (state->space_before) ruby_xfree(state->space_before);
state->space_before = strdup(RSTRING_PTR(space_before));
state->space_before = fstrndup(RSTRING_PTR(space_before), len);
state->space_before_len = len;
}
return Qnil;
Expand Down Expand Up @@ -1173,7 +1173,7 @@ static VALUE cState_object_nl_set(VALUE self, VALUE object_nl)
}
} else {
if (state->object_nl) ruby_xfree(state->object_nl);
state->object_nl = strdup(RSTRING_PTR(object_nl));
state->object_nl = fstrndup(RSTRING_PTR(object_nl), len);
state->object_nl_len = len;
}
return Qnil;
Expand Down Expand Up @@ -1208,7 +1208,7 @@ static VALUE cState_array_nl_set(VALUE self, VALUE array_nl)
}
} else {
if (state->array_nl) ruby_xfree(state->array_nl);
state->array_nl = strdup(RSTRING_PTR(array_nl));
state->array_nl = fstrndup(RSTRING_PTR(array_nl), len);
state->array_nl_len = len;
}
return Qnil;
Expand Down
1 change: 0 additions & 1 deletion ext/json/ext/generator/generator.h
@@ -1,7 +1,6 @@
#ifndef _GENERATOR_H_
#define _GENERATOR_H_

#include <string.h>
#include <math.h>
#include <ctype.h>

Expand Down

0 comments on commit 8f782fd

Please sign in to comment.