diff options
| author | Florian Frank <flori@ping.de> | 2017-03-02 12:12:33 +0100 |
|---|---|---|
| committer | Florian Frank <flori@ping.de> | 2017-04-10 09:35:01 +0200 |
| commit | e3faab528d402dda126df5cb9468fea15ba58ce0 (patch) | |
| tree | 8cacb6c1f06dfe0a32498969956e4422d769787e | |
| parent | 430253f49cf5ec241394118f475e88bfc3cca6cc (diff) | |
| download | json-e3faab528d402dda126df5cb9468fea15ba58ce0.tar.gz | |
Fix arbitrary heap exposure problem
| -rw-r--r-- | ext/json/ext/generator/generator.c | 12 | ||||
| -rw-r--r-- | ext/json/ext/generator/generator.h | 1 |
2 files changed, 6 insertions, 7 deletions
diff --git a/ext/json/ext/generator/generator.c b/ext/json/ext/generator/generator.c index ef85bb7..2bf8074 100644 --- a/ext/json/ext/generator/generator.c +++ b/ext/json/ext/generator/generator.c @@ -308,7 +308,7 @@ static char *fstrndup(const char *ptr, unsigned long len) { char *result; if (len <= 0) return NULL; result = ALLOC_N(char, len); - memccpy(result, ptr, 0, len); + memcpy(result, ptr, len); return result; } @@ -1062,7 +1062,7 @@ static VALUE cState_indent_set(VALUE self, VALUE indent) } } else { if (state->indent) ruby_xfree(state->indent); - state->indent = strdup(RSTRING_PTR(indent)); + state->indent = fstrndup(RSTRING_PTR(indent), len); state->indent_len = len; } return Qnil; @@ -1100,7 +1100,7 @@ static VALUE cState_space_set(VALUE self, VALUE space) } } else { if (state->space) ruby_xfree(state->space); - state->space = strdup(RSTRING_PTR(space)); + state->space = fstrndup(RSTRING_PTR(space), len); state->space_len = len; } return Qnil; @@ -1136,7 +1136,7 @@ static VALUE cState_space_before_set(VALUE self, VALUE space_before) } } else { if (state->space_before) ruby_xfree(state->space_before); - state->space_before = strdup(RSTRING_PTR(space_before)); + state->space_before = fstrndup(RSTRING_PTR(space_before), len); state->space_before_len = len; } return Qnil; @@ -1173,7 +1173,7 @@ static VALUE cState_object_nl_set(VALUE self, VALUE object_nl) } } else { if (state->object_nl) ruby_xfree(state->object_nl); - state->object_nl = strdup(RSTRING_PTR(object_nl)); + state->object_nl = fstrndup(RSTRING_PTR(object_nl), len); state->object_nl_len = len; } return Qnil; @@ -1208,7 +1208,7 @@ static VALUE cState_array_nl_set(VALUE self, VALUE array_nl) } } else { if (state->array_nl) ruby_xfree(state->array_nl); - state->array_nl = strdup(RSTRING_PTR(array_nl)); + state->array_nl = fstrndup(RSTRING_PTR(array_nl), len); state->array_nl_len = len; } return Qnil; diff --git a/ext/json/ext/generator/generator.h b/ext/json/ext/generator/generator.h index 900b4d5..c367a62 100644 --- a/ext/json/ext/generator/generator.h +++ b/ext/json/ext/generator/generator.h @@ -1,7 +1,6 @@ #ifndef _GENERATOR_H_ #define _GENERATOR_H_ -#include <string.h> #include <math.h> #include <ctype.h> |