Attachment #156407 for bug #225465




static ID id_cmp;

#define ARY_DEFAULT_SIZE 16
#define ARY_MAX_SIZE (LONG_MAX / sizeof(VALUE))

void
rb_mem_clear(mem, size)

    if (len < 0) {
	rb_raise(rb_eArgError, "negative array size (or size too big)");
    }
    if (len > ARY_MAX_SIZE) {
	rb_raise(rb_eArgError, "array size too big");
    }
    if (len == 0) len++;

    if (len < 0) {
	rb_raise(rb_eArgError, "negative array size");
    }
    if (len > ARY_MAX_SIZE) {
	rb_raise(rb_eArgError, "array size too big");
    }
    if (len > RARRAY(ary)->aux.capa) {

		    idx - RARRAY(ary)->len);
	}
    }
    else if (idx >= ARY_MAX_SIZE) {
       rb_raise(rb_eIndexError, "index %ld too big", idx);
    }

    rb_ary_modify(ary);
    if (idx >= RARRAY(ary)->aux.capa) {

	if (new_capa < ARY_DEFAULT_SIZE) {
	    new_capa = ARY_DEFAULT_SIZE;
	}
       else if (new_capa >= ARY_MAX_SIZE - idx) {
           new_capa = (ARY_MAX_SIZE - idx) / 2;
	    rb_raise(rb_eArgError, "index too big");
	}
       new_capa += idx;
	REALLOC_N(RARRAY(ary)->ptr, VALUE, new_capa);
	RARRAY(ary)->aux.capa = new_capa;
    }


    if (beg >= RARRAY(ary)->len) {
	len = beg + rlen;
       if (len < 0 || len > ARY_MAX_SIZE) {
           rb_raise(rb_eIndexError, "index %ld too big", beg);
       }
	if (len >= RARRAY(ary)->aux.capa) {
	    REALLOC_N(RARRAY(ary)->ptr, VALUE, len);
	    RARRAY(ary)->aux.capa = len;

    if (len < 0) {
	rb_raise(rb_eArgError, "negative argument");
    }
    if (ARY_MAX_SIZE/len < RARRAY(ary)->len) {
	rb_raise(rb_eArgError, "argument too big");
    }
    len *= RARRAY(ary)->len;

Lines 400-405 const char *ruby_signal_name _((int)); Link Here

(-)ruby-1.8.6-p114/intern.h (+1 lines)
400	void ruby_default_signal _((int));	400	void ruby_default_signal _((int));
401	/* sprintf.c */	401	/* sprintf.c */
402	VALUE rb_f_sprintf _((int, VALUE*));	402	VALUE rb_f_sprintf _((int, VALUE*));
		403	VALUE rb_str_format _((int, VALUE*, VALUE));
403	/* string.c */	404	/* string.c */
404	VALUE rb_str_new _((const char*, long));	405	VALUE rb_str_new _((const char*, long));
405	VALUE rb_str_new2 _((const char*));	406	VALUE rb_str_new2 _((const char*));




    int argc;
    VALUE *argv;
{
    return rb_str_format(argc - 1, argv + 1, GETNTHARG(0));
}

VALUE
rb_str_format(argc, argv, fmt)
    int argc;
    VALUE *argv;
    VALUE fmt;
{
    const char *p, *end;
    char *buf;
    int blen, bsiz;

   rb_raise(rb_eArgError, "flag after precision"); \
    }

    ++argc;
    --argv;
    if (OBJ_TAINTED(fmt)) tainted = 1;
    StringValue(fmt);
    fmt = rb_str_new4(fmt);




 */

static VALUE
rb_str_format_m(str, arg)
    VALUE str, arg;
{
    VALUE tmp = rb_check_array_type(arg);

    if (!NIL_P(tmp)) {
       return rb_str_format(RARRAY_LEN(tmp), RARRAY_PTR(tmp), str);
	argv[0] = str;
	MEMCPY(argv+1, RARRAY(arg)->ptr, VALUE, RARRAY(arg)->len);
	return rb_f_sprintf(RARRAY(arg)->len+1, argv);
    }
    return rb_str_format(1, &arg, str);
    argv = ALLOCA_N(VALUE, 2);
    argv[0] = str;
    argv[1] = arg;
    return rb_f_sprintf(2, argv);
}

static int

	capa = RSTRING(str)->aux.capa;
    }
    len = RSTRING(str)->len+RSTRING(str2)->len;
    if (len < 0 || (capa+1) > LONG_MAX / 2) {
       rb_raise(rb_eArgError, "string sizes too big");
    }
    if (capa <= len) {
	while (len > capa) {
	    capa = (capa + 1) * 2;

    rb_define_method(rb_cString, "casecmp", rb_str_casecmp, 1);
    rb_define_method(rb_cString, "+", rb_str_plus, 1);
    rb_define_method(rb_cString, "*", rb_str_times, 1);
    rb_define_method(rb_cString, "%", rb_str_format_m, 1);
    rb_define_method(rb_cString, "[]", rb_str_aref_m, -1);
    rb_define_method(rb_cString, "[]=", rb_str_aset_m, -1);
    rb_define_method(rb_cString, "insert", rb_str_insert, 2);

Return to bug 225465

Lines 20-25 VALUE rb_cArray; Link Here

(-)ruby-1.8.6-p114/array.c (-6 / +13 lines)
20	static ID id_cmp;	20	static ID id_cmp;
21		21
22	#define ARY_DEFAULT_SIZE 16	22	#define ARY_DEFAULT_SIZE 16
		23	#define ARY_MAX_SIZE (LONG_MAX / sizeof(VALUE))
23		24
24	void	25	void
25	rb_mem_clear(mem, size)	26	rb_mem_clear(mem, size)
Lines 120-126 ary_new(klass, len) Link Here
120	if (len < 0) {	121	if (len < 0) {
121	rb_raise(rb_eArgError, "negative array size (or size too big)");	122	rb_raise(rb_eArgError, "negative array size (or size too big)");
122	}	123	}
123	if (len > 0 && len * sizeof(VALUE) <= len) {	124	if (len > ARY_MAX_SIZE) {
124	rb_raise(rb_eArgError, "array size too big");	125	rb_raise(rb_eArgError, "array size too big");
125	}	126	}
126	if (len == 0) len++;	127	if (len == 0) len++;
Lines 293-299 rb_ary_initialize(argc, argv, ary) Link Here
293	if (len < 0) {	294	if (len < 0) {
294	rb_raise(rb_eArgError, "negative array size");	295	rb_raise(rb_eArgError, "negative array size");
295	}	296	}
296	if (len > 0 && len * (long)sizeof(VALUE) <= len) {	297	if (len > ARY_MAX_SIZE) {
297	rb_raise(rb_eArgError, "array size too big");	298	rb_raise(rb_eArgError, "array size too big");
298	}	299	}
299	if (len > RARRAY(ary)->aux.capa) {	300	if (len > RARRAY(ary)->aux.capa) {
Lines 358-363 rb_ary_store(ary, idx, val) Link Here
358	idx - RARRAY(ary)->len);	359	idx - RARRAY(ary)->len);
359	}	360	}
360	}	361	}
		362	else if (idx >= ARY_MAX_SIZE) {
		363	rb_raise(rb_eIndexError, "index %ld too big", idx);
		364	}
361		365
362	rb_ary_modify(ary);	366	rb_ary_modify(ary);
363	if (idx >= RARRAY(ary)->aux.capa) {	367	if (idx >= RARRAY(ary)->aux.capa) {
Lines 366-375 rb_ary_store(ary, idx, val) Link Here
366	if (new_capa < ARY_DEFAULT_SIZE) {	370	if (new_capa < ARY_DEFAULT_SIZE) {
367	new_capa = ARY_DEFAULT_SIZE;	371	new_capa = ARY_DEFAULT_SIZE;
368	}	372	}
369	new_capa += idx;	373	else if (new_capa >= ARY_MAX_SIZE - idx) {
370	if (new_capa * (long)sizeof(VALUE) <= new_capa) {	374	new_capa = (ARY_MAX_SIZE - idx) / 2;
371	rb_raise(rb_eArgError, "index too big");
372	}	375	}
		376	new_capa += idx;
373	REALLOC_N(RARRAY(ary)->ptr, VALUE, new_capa);	377	REALLOC_N(RARRAY(ary)->ptr, VALUE, new_capa);
374	RARRAY(ary)->aux.capa = new_capa;	378	RARRAY(ary)->aux.capa = new_capa;
375	}	379	}
Lines 976-981 rb_ary_splice(ary, beg, len, rpl) Link Here
976		980
977	if (beg >= RARRAY(ary)->len) {	981	if (beg >= RARRAY(ary)->len) {
978	len = beg + rlen;	982	len = beg + rlen;
		983	if (len < 0 \|\| len > ARY_MAX_SIZE) {
		984	rb_raise(rb_eIndexError, "index %ld too big", beg);
		985	}
979	if (len >= RARRAY(ary)->aux.capa) {	986	if (len >= RARRAY(ary)->aux.capa) {
980	REALLOC_N(RARRAY(ary)->ptr, VALUE, len);	987	REALLOC_N(RARRAY(ary)->ptr, VALUE, len);
981	RARRAY(ary)->aux.capa = len;	988	RARRAY(ary)->aux.capa = len;
Lines 2378-2384 rb_ary_times(ary, times) Link Here
2378	if (len < 0) {	2385	if (len < 0) {
2379	rb_raise(rb_eArgError, "negative argument");	2386	rb_raise(rb_eArgError, "negative argument");
2380	}	2387	}
2381	if (LONG_MAX/len < RARRAY(ary)->len) {	2388	if (ARY_MAX_SIZE/len < RARRAY(ary)->len) {
2382	rb_raise(rb_eArgError, "argument too big");	2389	rb_raise(rb_eArgError, "argument too big");
2383	}	2390	}
2384	len *= RARRAY(ary)->len;	2391	len *= RARRAY(ary)->len;

Lines 247-253 rb_f_sprintf(argc, argv) Link Here

(-)ruby-1.8.6-p114/sprintf.c (-1 / +10 lines)
247	int argc;	247	int argc;
248	VALUE *argv;	248	VALUE *argv;
249	{	249	{
		250	return rb_str_format(argc - 1, argv + 1, GETNTHARG(0));
		251	}
		252
		253	VALUE
		254	rb_str_format(argc, argv, fmt)
		255	int argc;
		256	VALUE *argv;
250	VALUE fmt;	257	VALUE fmt;
		258	{
251	const char p, end;	259	const char p, end;
252	char *buf;	260	char *buf;
253	int blen, bsiz;	261	int blen, bsiz;
Lines 276-282 rb_f_sprintf(argc, argv) Link Here
276	rb_raise(rb_eArgError, "flag after precision"); \	284	rb_raise(rb_eArgError, "flag after precision"); \
277	}	285	}
278		286
279	fmt = GETNTHARG(0);	287	++argc;
		288	--argv;
280	if (OBJ_TAINTED(fmt)) tainted = 1;	289	if (OBJ_TAINTED(fmt)) tainted = 1;
281	StringValue(fmt);	290	StringValue(fmt);
282	fmt = rb_str_new4(fmt);	291	fmt = rb_str_new4(fmt);

Lines 452-473 rb_str_times(str, times) Link Here

(-)ruby-1.8.6-p114/string.c (-13 / +9 lines)
452	*/	452	*/
453		453
454	static VALUE	454	static VALUE
455	rb_str_format(str, arg)	455	rb_str_format_m(str, arg)
456	VALUE str, arg;	456	VALUE str, arg;
457	{	457	{
458	VALUE *argv;	458	VALUE tmp = rb_check_array_type(arg);
459		459
460	if (TYPE(arg) == T_ARRAY) {	460	if (!NIL_P(tmp)) {
461	argv = ALLOCA_N(VALUE, RARRAY(arg)->len + 1);	461	return rb_str_format(RARRAY_LEN(tmp), RARRAY_PTR(tmp), str);
462	argv[0] = str;
463	MEMCPY(argv+1, RARRAY(arg)->ptr, VALUE, RARRAY(arg)->len);
464	return rb_f_sprintf(RARRAY(arg)->len+1, argv);
465	}	462	}
466		463	return rb_str_format(1, &arg, str);
467	argv = ALLOCA_N(VALUE, 2);
468	argv[0] = str;
469	argv[1] = arg;
470	return rb_f_sprintf(2, argv);
471	}	464	}
472		465
473	static int	466	static int
Lines 780-785 rb_str_buf_append(str, str2) Link Here
780	capa = RSTRING(str)->aux.capa;	773	capa = RSTRING(str)->aux.capa;
781	}	774	}
782	len = RSTRING(str)->len+RSTRING(str2)->len;	775	len = RSTRING(str)->len+RSTRING(str2)->len;
		776	if (len < 0 \|\| (capa+1) > LONG_MAX / 2) {
		777	rb_raise(rb_eArgError, "string sizes too big");
		778	}
783	if (capa <= len) {	779	if (capa <= len) {
784	while (len > capa) {	780	while (len > capa) {
785	capa = (capa + 1) * 2;	781	capa = (capa + 1) * 2;
Lines 4657-4663 Init_String() Link Here
4657	rb_define_method(rb_cString, "casecmp", rb_str_casecmp, 1);	4653	rb_define_method(rb_cString, "casecmp", rb_str_casecmp, 1);
4658	rb_define_method(rb_cString, "+", rb_str_plus, 1);	4654	rb_define_method(rb_cString, "+", rb_str_plus, 1);
4659	rb_define_method(rb_cString, "*", rb_str_times, 1);	4655	rb_define_method(rb_cString, "*", rb_str_times, 1);
4660	rb_define_method(rb_cString, "%", rb_str_format, 1);	4656	rb_define_method(rb_cString, "%", rb_str_format_m, 1);
4661	rb_define_method(rb_cString, "[]", rb_str_aref_m, -1);	4657	rb_define_method(rb_cString, "[]", rb_str_aref_m, -1);
4662	rb_define_method(rb_cString, "[]=", rb_str_aset_m, -1);	4658	rb_define_method(rb_cString, "[]=", rb_str_aset_m, -1);
4663	rb_define_method(rb_cString, "insert", rb_str_insert, 2);	4659	rb_define_method(rb_cString, "insert", rb_str_insert, 2);