Fix integer overflow

nobu · mame · commit c6a37a671b55 · 2021-11-24T19:41:00.000+09:00
Make use of the check in rb_alloc_tmp_buffer2. https://hackerone.com/reports/1328463
diff --git a/ext/cgi/escape/escape.c b/ext/cgi/escape/escape.c
@@ -36,7 +36,8 @@ static VALUE
 optimized_escape_html(VALUE str)
 {
     VALUE vbuf;
-    char *buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) * HTML_ESCAPE_MAX_LEN);
+    typedef char escape_buf[HTML_ESCAPE_MAX_LEN];
+    char *buf = *ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));
     const char *cstr = RSTRING_PTR(str);
     const char *end = cstr + RSTRING_LEN(str);
 

Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,8 @@ static VALUE`
`36`	`36`	`optimized_escape_html(VALUE str)`
`37`	`37`	`{`
`38`	`38`	`VALUE vbuf;`
`39`		`- char buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) HTML_ESCAPE_MAX_LEN);`
	`39`	`+ typedef char escape_buf[HTML_ESCAPE_MAX_LEN];`
	`40`	`+ char buf = ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));`
`40`	`41`	`const char *cstr = RSTRING_PTR(str);`
`41`	`42`	`const char *end = cstr + RSTRING_LEN(str);`
`42`	`43`