Permalink
Browse files

Make sure str->capa is under MRB_INT_MAX; fix #3342

  • Loading branch information...
matz committed Dec 13, 2016
1 parent 647ad29 commit 3a7c3695360e598ce4279a979cc9138a35971615
Showing with 3 additions and 3 deletions.
  1. +3 −3 src/string.c
View
@@ -156,14 +156,14 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
else
capa = s->as.heap.aux.capa;
if (RSTR_LEN(s) >= MRB_INT_MAX - (mrb_int)len) {
total = RSTR_LEN(s)+len;
if (total >= MRB_INT_MAX) {
mrb_raise(mrb, E_ARGUMENT_ERROR, "string size too big");
}
total = RSTR_LEN(s)+len;
if (capa <= total) {
while (total > capa) {
if (capa + 1 >= MRB_INT_MAX / 2) {
capa = (total + 4095) / 4096;
capa = MRB_INT_MAX;
break;
}
capa = (capa + 1) * 2;

0 comments on commit 3a7c369

Please sign in to comment.