Skip to content

Commit 6afff1c

Browse files
matzclaude
andcommitted
string.c: fix integer overflow in str_check_length()
Reject MRB_INT_MAX length strings to prevent signed integer overflow when adding 1 for the null terminator in str_init_normal_capa() and resize_capa(). Co-authored-by: Claude <noreply@anthropic.com>
1 parent b287c12 commit 6afff1c

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/string.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ const char mrb_digitmap[] = "0123456789abcdefghijklmnopqrstuvwxyz";
4040
static void
4141
str_check_length(mrb_state *mrb, mrb_int len)
4242
{
43-
if (len < 0) {
43+
if (len < 0 || len == MRB_INT_MAX) {
4444
mrb_raise(mrb, E_ARGUMENT_ERROR, "negative (or overflowed) string size");
4545
}
4646
#if MRB_STR_LENGTH_MAX != 0

0 commit comments

Comments
 (0)