Permalink
Browse files

when length/2 overflowed, uninitialized memory was put in the string …

…buffer
  • Loading branch information...
1 parent 306a9f3 commit f15c95e209e91a003e0b60d4b023a022a4d6afd4 @pietern committed Feb 10, 2010
Showing with 6 additions and 3 deletions.
  1. +2 −3 ext/simple_mmap/mapped_file.c
  2. +4 −0 test/test_file_window.rb
@@ -130,12 +130,11 @@ static VALUE sm_mapped_file_read_window_data(VALUE vself, VALUE voffset, VALUE v
return Qnil;
}
- size_t curr;
- curr = offset;
+ size_t curr = offset;
size_t i;
for(i = 0; i < length; ++i) {
//printf("i=%i offset=%i length=%i curr=%i map->len=%i\n", i, offset, length, curr, sm_map->len);
- if ((curr + i) > sm_map->len)
+ if ((offset + i) > sm_map->len)
break;
buff[i] = sm_map->map[curr++];
}
View
@@ -43,6 +43,10 @@ def test_get_bytes_past_length
assert_equal "z", @fw[25, 10]
end
+ def test_get_all_bytes
+ assert_equal ('a'..'z').to_a.join, @fw[0, 26]
+ end
+
def test_nil_on_negative_index
assert_equal nil, @fw[-1]
assert_equal nil, @fw[-1, 2]

0 comments on commit f15c95e

Please sign in to comment.