Bug #3700

Buffer overrun in util.c: ruby_hdtoa / nrv_alloc

Added by Peter Weldon over 4 years ago. Updated almost 4 years ago.

[ruby-core:31725]
Status:Closed
Priority:Normal
Assignee:-
ruby -v:ruby 1.9.3dev (2010-08-15) [i386-mswin32_100] Backport:

Description

=begin
util.c (ruby_hdtoa) causes buffer overrun in nrv_alloc when returning copies of constant strings ("0", "NaN", "Infinity"). Detected while running ruby 1.9.3dev (2010-08-15) [i386-mswin32_100], linked with debug crt libs, heap corruption is detected while running test/ruby/test_sprintf.rb.

Patch attached:
- consistently handling of const return strings in ruby_hdtoa, ruby_dtoa, using rv_strdup
- avoid strlen in rv_strdup
- remove handrolled memcpy in nrv_alloc
=end

i386-mswin32_100.txt Magnifier - Heap corruption call stack (5.73 KB) Peter Weldon, 08/16/2010 01:38 PM

util.c.patch Magnifier - util.c patch (2.16 KB) Peter Weldon, 08/16/2010 01:38 PM

History

#1 Updated by Nobuyoshi Nakada over 4 years ago

  • Status changed from Open to Closed
  • % Done changed from 0 to 100

=begin
This issue was solved with changeset r29010.
Peter, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.

=end

Also available in: Atom PDF