Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Merge pull request #667 from appozite/1.10.0-syck

Backported Syck Patch for 1.8.6 to Guard Against Buffer Overflows
  • Loading branch information...
commit 7fdad699aa082402de66e65c9ec71a16a0db6d16 2 parents b713175 + 352e109
@mpapis mpapis authored
Showing with 21 additions and 0 deletions.
  1. +20 −0 patches/ruby/1.8.6/syck.patch
  2. +1 −0  patchsets/ruby/1.8.6/default
View
20 patches/ruby/1.8.6/syck.patch
@@ -0,0 +1,20 @@
+diff --git a/ext/syck/rubyext.c b/ext/syck/rubyext.c
+index 078de4f..8c4027f 100644
+--- a/ext/syck/rubyext.c
++++ b/ext/syck/rubyext.c
+@@ -268,9 +268,13 @@ rb_syck_mktime(str, len)
+ {
+ char padded[] = "000000";
+ char *end = ptr + 1;
++ char *p = end;
+ while ( isdigit( *end ) ) end++;
+- MEMCPY(padded, ptr + 1, char, end - (ptr + 1));
+- usec = strtol(padded, NULL, 10);
++ if (end - p < sizeof(padded)) {
++ MEMCPY(padded, ptr + 1, char, end - (ptr + 1));
++ p = padded;
++ }
++ usec = strtol(p, NULL, 10);
+ }
+ else
+ {
View
1  patchsets/ruby/1.8.6/default
@@ -1,3 +1,4 @@
openssl-1.0
stdout-rouge-fix
no_sslv2
+syck
Please sign in to comment.
Something went wrong with that request. Please try again.