Skip to content

Commit 8f782fd

Browse files
committed
Fix arbitrary heap exposure problem
1 parent c9fc0f0 commit 8f782fd

File tree

2 files changed

+6
-7
lines changed

2 files changed

+6
-7
lines changed

Diff for: ext/json/ext/generator/generator.c

+6-6
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ static char *fstrndup(const char *ptr, unsigned long len) {
308308
char *result;
309309
if (len <= 0) return NULL;
310310
result = ALLOC_N(char, len);
311-
memccpy(result, ptr, 0, len);
311+
memcpy(result, ptr, len);
312312
return result;
313313
}
314314

@@ -1062,7 +1062,7 @@ static VALUE cState_indent_set(VALUE self, VALUE indent)
10621062
}
10631063
} else {
10641064
if (state->indent) ruby_xfree(state->indent);
1065-
state->indent = strdup(RSTRING_PTR(indent));
1065+
state->indent = fstrndup(RSTRING_PTR(indent), len);
10661066
state->indent_len = len;
10671067
}
10681068
return Qnil;
@@ -1100,7 +1100,7 @@ static VALUE cState_space_set(VALUE self, VALUE space)
11001100
}
11011101
} else {
11021102
if (state->space) ruby_xfree(state->space);
1103-
state->space = strdup(RSTRING_PTR(space));
1103+
state->space = fstrndup(RSTRING_PTR(space), len);
11041104
state->space_len = len;
11051105
}
11061106
return Qnil;
@@ -1136,7 +1136,7 @@ static VALUE cState_space_before_set(VALUE self, VALUE space_before)
11361136
}
11371137
} else {
11381138
if (state->space_before) ruby_xfree(state->space_before);
1139-
state->space_before = strdup(RSTRING_PTR(space_before));
1139+
state->space_before = fstrndup(RSTRING_PTR(space_before), len);
11401140
state->space_before_len = len;
11411141
}
11421142
return Qnil;
@@ -1173,7 +1173,7 @@ static VALUE cState_object_nl_set(VALUE self, VALUE object_nl)
11731173
}
11741174
} else {
11751175
if (state->object_nl) ruby_xfree(state->object_nl);
1176-
state->object_nl = strdup(RSTRING_PTR(object_nl));
1176+
state->object_nl = fstrndup(RSTRING_PTR(object_nl), len);
11771177
state->object_nl_len = len;
11781178
}
11791179
return Qnil;
@@ -1208,7 +1208,7 @@ static VALUE cState_array_nl_set(VALUE self, VALUE array_nl)
12081208
}
12091209
} else {
12101210
if (state->array_nl) ruby_xfree(state->array_nl);
1211-
state->array_nl = strdup(RSTRING_PTR(array_nl));
1211+
state->array_nl = fstrndup(RSTRING_PTR(array_nl), len);
12121212
state->array_nl_len = len;
12131213
}
12141214
return Qnil;

Diff for: ext/json/ext/generator/generator.h

-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
#ifndef _GENERATOR_H_
22
#define _GENERATOR_H_
33

4-
#include <string.h>
54
#include <math.h>
65
#include <ctype.h>
76

0 commit comments

Comments
 (0)