* array.c (ary_new, rb_ary_initialize, rb_ary_store,

rb_ary_aplice, rb_ary_times): integer overflows should be
  checked. based on patches from Drew Yao <ayao at apple.com>
  fixed CVE-2008-2726

* string.c (rb_str_buf_append): fixed unsafe use of alloca,
  which led memory corruption. based on a patch from Drew Yao
  <ayao at apple.com> fixed CVE-2008-2726

* sprintf.c (rb_str_format): backported from trunk.

* intern.h: ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,14 @@
+Wed Jun 18 21:52:38 2008  URABE Shyouhei  <shyouhei@ruby-lang.org>
+
+	* array.c (ary_new, rb_ary_initialize, rb_ary_store,
+	  rb_ary_aplice, rb_ary_times): integer overflows should be
+	  checked. based on patches from Drew Yao <ayao at apple.com>
+	  fixed CVE-2008-2726
+
+	* string.c (rb_enc_cr_str_buf_cat): fixed unsafe use of alloca,
+	  which led memory corruption. based on a patch from Drew Yao
+	  <ayao at apple.com> fixed CVE-2008-2726
+
 Fri Jun 20 03:26:00 2008  NAKAMURA Usaku  <usa@ruby-lang.org>
 
 	* process.c (rb_f_fork): NetBSD 4.0 or later can fork.

array.c

@@ -20,6 +20,7 @@ VALUE rb_cArray;
 static ID id_cmp;
 
 #define ARY_DEFAULT_SIZE 16
+#define ARY_MAX_SIZE (LONG_MAX / sizeof(VALUE))
 
 void
 rb_mem_clear(register VALUE *mem, register long size)
@@ -114,7 +115,7 @@ ary_new(VALUE klass, long len)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative array size (or size too big)");
     }
-    if (len > LONG_MAX / sizeof(VALUE)) {
+    if (len > ARY_MAX_SIZE) {
 	rb_raise(rb_eArgError, "array size too big");
     }
     ary = ary_alloc(klass);
@@ -313,7 +314,7 @@ rb_ary_initialize(int argc, VALUE *argv, VALUE ary)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative array size");
     }
-    if (len > LONG_MAX / sizeof(VALUE)) {
+    if (len > ARY_MAX_SIZE) {
 	rb_raise(rb_eArgError, "array size too big");
     }
     rb_ary_modify(ary);
@@ -371,6 +372,9 @@ rb_ary_store(VALUE ary, long idx, VALUE val)
 		     idx - RARRAY_LEN(ary));
 	}
     }
+    else if (idx >= ARY_MAX_SIZE) {
+	rb_raise(rb_eIndexError, "index %ld too big", idx);
+    }
 
     rb_ary_modify(ary);
     if (idx >= ARY_CAPA(ary)) {
@@ -379,13 +383,10 @@ rb_ary_store(VALUE ary, long idx, VALUE val)
 	if (new_capa < ARY_DEFAULT_SIZE) {
 	    new_capa = ARY_DEFAULT_SIZE;
 	}
-	if (new_capa + idx < new_capa) {
-	    rb_raise(rb_eArgError, "index too big");
+	else if (new_capa >= ARY_MAX_SIZE - idx) {
+	    new_capa = (ARY_MAX_SIZE - idx) / 2;
 	}
 	new_capa += idx;
-	if (new_capa * (long)sizeof(VALUE) <= new_capa) {
-	    rb_raise(rb_eArgError, "index too big");
-	}
 	RESIZE_CAPA(ary, new_capa);
     }
     if (idx > RARRAY_LEN(ary)) {
@@ -986,6 +987,9 @@ rb_ary_splice(VALUE ary, long beg, long len, VALUE rpl)
     rb_ary_modify(ary);
     if (beg >= RARRAY_LEN(ary)) {
 	len = beg + rlen;
+	if (len < 0 || len > ARY_MAX_SIZE) {
+	    rb_raise(rb_eIndexError, "index %ld too big", beg);
+	}
 	if (len >= ARY_CAPA(ary)) {
 	    RESIZE_CAPA(ary, len);
 	}
@@ -2250,7 +2254,7 @@ rb_ary_times(VALUE ary, VALUE times)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative argument");
     }
-    if (LONG_MAX/len < RARRAY_LEN(ary)) {
+    if (ARY_MAX_SIZE/len < RARRAY_LEN(ary)) {
 	rb_raise(rb_eArgError, "argument too big");
     }
     len *= RARRAY_LEN(ary);

string.c

@@ -1562,6 +1562,9 @@ rb_enc_cr_str_buf_cat(VALUE str, const char *ptr, long len,
 	capa = RSTRING(str)->as.heap.aux.capa;
     }
     total = RSTRING_LEN(str)+len;
+    if (total < 0 || capa + 1 > LONG_MAX / 2) {
+	rb_raise(rb_eArgError, "string sizes too big");
+    }
     if (capa <= total) {
 	while (total > capa) {
 	    capa = (capa + 1) * 2;