Permalink
Browse files

mrb_str_len_to_inum(): string may not be NUL terminated; ref #3043

  • Loading branch information...
matz committed Dec 14, 2015
1 parent 19c744e commit 2a234a93d769cf90bf52990a89d0817416fd3185
Showing with 9 additions and 2 deletions.
  1. +9 −2 src/string.c
View
@@ -2124,6 +2124,10 @@ mrb_str_len_to_inum(mrb_state *mrb, const char *str, size_t len, int base, int b
}
break;
} /* end of switch (base) { */
if (p>=pend) {
if (badcheck) goto bad;
return mrb_fixnum_value(0);
}
if (*p == '0') { /* squeeze preceding 0s */
p++;
while (p<pend) {
@@ -2153,14 +2157,17 @@ mrb_str_len_to_inum(mrb_state *mrb, const char *str, size_t len, int base, int b
for ( ;p<pend;p++) {
if (*p == '_') {
if (p[1] == '_') {
if (p+1<pend && p[1] == '_') {
if (badcheck) goto bad;
continue;
}
p++;
if (badcheck && p<pend)
goto bad;
}
if (badcheck && *p == '\0') {
goto nullbyte;
break;
}
c = conv_digit(*p);
if (c < 0 || c >= base) {
@@ -2186,7 +2193,7 @@ mrb_str_len_to_inum(mrb_state *mrb, const char *str, size_t len, int base, int b
/* not reached */
bad:
mrb_raisef(mrb, E_ARGUMENT_ERROR, "invalid string for number(%S)",
mrb_inspect(mrb, mrb_str_new_cstr(mrb, str)));
mrb_inspect(mrb, mrb_str_new(mrb, str, pend-str)));
/* not reached */
return mrb_fixnum_value(0);
}

0 comments on commit 2a234a9

Please sign in to comment.