1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[Bug #21380] Prohibit modification in String#split block

Browse Source 
Reported at https://hackerone.com/reports/3163876
This commit is contained in:
Nobuyoshi Nakada 2025-05-27 22:24:28 +09:00
parent 7082ef201e
commit fa85d23ff4
No known key found for this signature in database
GPG Key ID: 3582D74E1FEE4465
Notes: git 2025-05-29 02:59:26 +00:00 
Merged: https://github.com/ruby/ruby/pull/13462
2 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
string.c
View File

@ -9748,11 +9748,15 @@ rb_str_split_m(int argc, VALUE *argv, VALUE str)
}
}
#define SPLIT_STR(beg, len) (empty_count = split_string(result, str, beg, len, empty_count))
#define SPLIT_STR(beg, len) ( \
empty_count = split_string(result, str, beg, len, empty_count), \
str_mod_check(str, str_start, str_len))
beg = 0;
char *ptr = RSTRING_PTR(str);
char *eptr = RSTRING_END(str);
char *const str_start = ptr;
const long str_len = RSTRING_LEN(str);
char *const eptr = str_start + str_len;
if (split_type == SPLIT_TYPE_AWK) {
char *bptr = ptr;
int skip = 1;
@ -9813,7 +9817,6 @@ rb_str_split_m(int argc, VALUE *argv, VALUE str)
}
}
else if (split_type == SPLIT_TYPE_STRING) {
char *str_start = ptr;
char *substr_start = ptr;
char *sptr = RSTRING_PTR(spat);
long slen = RSTRING_LEN(spat);
@ -9830,6 +9833,7 @@ rb_str_split_m(int argc, VALUE *argv, VALUE str)
continue;
}
SPLIT_STR(substr_start - str_start, (ptr+end) - substr_start);
str_mod_check(spat, sptr, slen);
ptr += end + slen;
substr_start = ptr;
if (!NIL_P(limit) && lim <= ++i) break;
@ -9837,7 +9841,6 @@ rb_str_split_m(int argc, VALUE *argv, VALUE str)
beg = ptr - str_start;
}
else if (split_type == SPLIT_TYPE_CHARS) {
char *str_start = ptr;
int n;
if (result) result = rb_ary_new_capa(RSTRING_LEN(str));

7
test/ruby/test_string.rb
View File

@ -1869,6 +1869,13 @@ CODE
result = []; S("aaa,bbb,ccc,ddd").split(/,/) {|s| result << s.gsub(/./, "A")}
assert_equal(["AAA"]*4, result)
s = S("abc ") * 20
assert_raise(RuntimeError) {
10.times do
s.split {s.prepend("xxx" * 100)}
end
}
ensure
EnvUtil.suppress_warning {$; = fs}
end