Fix integer overflow

Make use of the check in rb_alloc_tmp_buffer2. https://hackerone.com/reports/1328463
ruby · Nov 24, 2021 · c6a37a6 · c6a37a6
1 parent 8f0b257
commit c6a37a6
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/ext/cgi/escape/escape.c b/ext/cgi/escape/escape.c
@@ -36,7 +36,8 @@ static VALUE
 optimized_escape_html(VALUE str)
 {
     VALUE vbuf;
-    char *buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) * HTML_ESCAPE_MAX_LEN);
+    typedef char escape_buf[HTML_ESCAPE_MAX_LEN];
+    char *buf = *ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));
     const char *cstr = RSTRING_PTR(str);
     const char *end = cstr + RSTRING_LEN(str);