Permalink
Browse files

str_buf_cat(): better size check added; ref #3342

  • Loading branch information...
matz committed Dec 31, 2016
1 parent 342b1de commit 1ed4de58d016a25d8a6ae4576e447dab1709535c
Showing with 9 additions and 4 deletions.
  1. +9 −4 src/string.c
View
@@ -163,15 +163,20 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
total = RSTR_LEN(s)+len;
if (total >= MRB_INT_MAX) {
size_error:
mrb_raise(mrb, E_ARGUMENT_ERROR, "string size too big");
}
if (capa <= total) {
while (total > capa) {
if (capa + 1 >= MRB_INT_MAX / 2) {
capa = MRB_INT_MAX;
break;
if (capa <= MRB_INT_MAX / 2) {
capa *= 2;
}
else {
goto size_error;
}
capa = (capa + 1) * 2;
}
if (capa < total || capa > MRB_INT_MAX) {
goto size_error;
}
resize_capa(mrb, s, capa);
}

0 comments on commit 1ed4de5

Please sign in to comment.