diff options
author | Florian Frank <flori@ping.de> | 2017-03-02 12:12:33 +0100 |
---|---|---|
committer | Florian Frank <flori@ping.de> | 2017-04-18 10:38:41 +0200 |
commit | 8f782fd8e181d9cfe9387ded43a5ca9692266b85 (patch) | |
tree | e232c9b30c38aeabfc685b0ffceec2cadceaf8aa /ext | |
parent | c9fc0f047b11497bb30c75880a9f5af7698d350b (diff) | |
download | json-8f782fd8e181d9cfe9387ded43a5ca9692266b85.tar.gz |
Fix arbitrary heap exposure problem
Diffstat (limited to 'ext')
-rw-r--r-- | ext/json/ext/generator/generator.c | 12 | ||||
-rw-r--r-- | ext/json/ext/generator/generator.h | 1 |
2 files changed, 6 insertions, 7 deletions
diff --git a/ext/json/ext/generator/generator.c b/ext/json/ext/generator/generator.c index ef85bb7..2bf8074 100644 --- a/ext/json/ext/generator/generator.c +++ b/ext/json/ext/generator/generator.c @@ -308,7 +308,7 @@ static char *fstrndup(const char *ptr, unsigned long len) { char *result; if (len <= 0) return NULL; result = ALLOC_N(char, len); - memccpy(result, ptr, 0, len); + memcpy(result, ptr, len); return result; } @@ -1062,7 +1062,7 @@ static VALUE cState_indent_set(VALUE self, VALUE indent) } } else { if (state->indent) ruby_xfree(state->indent); - state->indent = strdup(RSTRING_PTR(indent)); + state->indent = fstrndup(RSTRING_PTR(indent), len); state->indent_len = len; } return Qnil; @@ -1100,7 +1100,7 @@ static VALUE cState_space_set(VALUE self, VALUE space) } } else { if (state->space) ruby_xfree(state->space); - state->space = strdup(RSTRING_PTR(space)); + state->space = fstrndup(RSTRING_PTR(space), len); state->space_len = len; } return Qnil; @@ -1136,7 +1136,7 @@ static VALUE cState_space_before_set(VALUE self, VALUE space_before) } } else { if (state->space_before) ruby_xfree(state->space_before); - state->space_before = strdup(RSTRING_PTR(space_before)); + state->space_before = fstrndup(RSTRING_PTR(space_before), len); state->space_before_len = len; } return Qnil; @@ -1173,7 +1173,7 @@ static VALUE cState_object_nl_set(VALUE self, VALUE object_nl) } } else { if (state->object_nl) ruby_xfree(state->object_nl); - state->object_nl = strdup(RSTRING_PTR(object_nl)); + state->object_nl = fstrndup(RSTRING_PTR(object_nl), len); state->object_nl_len = len; } return Qnil; @@ -1208,7 +1208,7 @@ static VALUE cState_array_nl_set(VALUE self, VALUE array_nl) } } else { if (state->array_nl) ruby_xfree(state->array_nl); - state->array_nl = strdup(RSTRING_PTR(array_nl)); + state->array_nl = fstrndup(RSTRING_PTR(array_nl), len); state->array_nl_len = len; } return Qnil; diff --git a/ext/json/ext/generator/generator.h b/ext/json/ext/generator/generator.h index 900b4d5..c367a62 100644 --- a/ext/json/ext/generator/generator.h +++ b/ext/json/ext/generator/generator.h @@ -1,7 +1,6 @@ #ifndef _GENERATOR_H_ #define _GENERATOR_H_ -#include <string.h> #include <math.h> #include <ctype.h> |