Skip to content

Commit

Permalink
Ruby: Prevent a possible integer underflow
Browse files Browse the repository at this point in the history
Coverity picked up a potential issue with the previous commit d9f5f1f
("Ruby: Handle response field arrays") in that a size_t could wrap
around to SIZE_MAX - 1.

This would happen if we were given an empty array of header values.

Fixes: d9f5f1f ("Ruby: Handle response field arrays")
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
  • Loading branch information
ac000 committed Dec 13, 2023
1 parent d9f5f1f commit 88854cf
Showing 1 changed file with 8 additions and 2 deletions.
10 changes: 8 additions & 2 deletions src/ruby/nxt_ruby.c
Original file line number Diff line number Diff line change
Expand Up @@ -914,8 +914,12 @@ nxt_ruby_hash_info(VALUE r_key, VALUE r_value, VALUE arg)
len += RSTRING_LEN(item) + 2; /* +2 for '; ' */
}

if (arr_len > 0) {
len -= 2;
}

headers_info->fields++;
headers_info->size += RSTRING_LEN(r_key) + len - 2;
headers_info->size += RSTRING_LEN(r_key) + len;

return ST_CONTINUE;
}
Expand Down Expand Up @@ -994,7 +998,9 @@ nxt_ruby_hash_add(VALUE r_key, VALUE r_value, VALUE arg)
p = nxt_cpymem(p, "; ", 2);
}

len -= 2;
if (arr_len > 0) {
len -= 2;
}

*rc = nxt_unit_response_add_field(headers_info->req,
RSTRING_PTR(r_key), key_len,
Expand Down

0 comments on commit 88854cf

Please sign in to comment.