when length/2 overflowed, uninitialized memory was put in the string …

…buffer
pietern · Feb 10, 2010 · f15c95e · f15c95e
1 parent 306a9f3
commit f15c95e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/ext/simple_mmap/mapped_file.c b/ext/simple_mmap/mapped_file.c
@@ -130,12 +130,11 @@ static VALUE sm_mapped_file_read_window_data(VALUE vself, VALUE voffset, VALUE v
     return Qnil;
   }
 
-  size_t curr;
-  curr = offset;
+  size_t curr = offset;
   size_t i;
   for(i = 0; i < length; ++i) {
     //printf("i=%i offset=%i length=%i curr=%i map->len=%i\n", i, offset, length, curr, sm_map->len);
-    if ((curr + i) > sm_map->len)
+    if ((offset + i) > sm_map->len)
       break;
     buff[i] = sm_map->map[curr++];
   }

diff --git a/test/test_file_window.rb b/test/test_file_window.rb
@@ -43,6 +43,10 @@ def test_get_bytes_past_length
     assert_equal "z", @fw[25, 10]
   end
 
+  def test_get_all_bytes
+    assert_equal ('a'..'z').to_a.join, @fw[0, 26]
+  end
+
   def test_nil_on_negative_index
     assert_equal nil, @fw[-1]
     assert_equal nil, @fw[-1, 2]