Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Raise RangeError for out of bounds unpack_at #6306

Merged
merged 1 commit into from Jun 30, 2020

Conversation

headius
Copy link
Member

@headius headius commented Jun 29, 2020

This corrects the error raised for the case where the unpack spec
requests a size that's outside the string, which relates to
CVE-2018-8778.

The other two cases that raised the ArgumentError for "outside of
string" appear to be correct, since making them raise RangeError
causes spec failures.

This addresses a security spec failure as shown in #6304.

@headius headius added this to the JRuby 9.2.12.0 milestone Jun 29, 2020
This corrects the error raised for the case where the unpack spec
requests a size that's outside the string, which relates to
CVE-2018-8778.

The other two cases that raised the ArgumentError for "outside of
string" appear to be correct, since making them raise RangeError
causes spec failures.

This addresses a security spec failure as shown in jruby#6304.
@headius headius force-pushed the range_error_for_overbig_unpack branch from 4768624 to a56c5e4 Compare Jun 29, 2020
@headius headius merged commit 3b3cbaa into jruby:jruby-9.2 Jun 30, 2020
1 check passed
@headius headius deleted the range_error_for_overbig_unpack branch Jun 30, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant