parse.y: fix buffer overflow with tweaked mruby binary.
MODIFY
mrbgems/mruby-compiler/core/parse.y
mrbgems/mruby-compiler/core/parse.y
@@ -6934,12 +6934,13 @@ mrb_load_detect_file_cxt(mrb_state *mrb, FILE *fp, mrbc_context *c)
binsize = bin_to_uint32(leading.h.binary_size);
bin_obj = mrb_str_new(mrb, NULL, binsize);
bin = (uint8_t *)RSTRING_PTR(bin_obj);
+ if (binsize > bufsize) {
memcpy(bin, leading.b, bufsize);
- if (binsize > bufsize &&
- fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
+ if (fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
}
+ }
result = mrb_load_irep_buf_cxt(mrb, bin, binsize, c);
if (mrb_string_p(bin_obj)) mrb_str_resize(mrb, bin_obj, 0);

MODIFY
mrbgems/mruby-compiler/core/y.tab.c
mrbgems/mruby-compiler/core/y.tab.c
@@ -13161,12 +13161,13 @@ mrb_load_detect_file_cxt(mrb_state *mrb, FILE *fp, mrbc_context *c)
binsize = bin_to_uint32(leading.h.binary_size);
bin_obj = mrb_str_new(mrb, NULL, binsize);
bin = (uint8_t *)RSTRING_PTR(bin_obj);
+ if (binsize > bufsize) {
memcpy(bin, leading.b, bufsize);
- if (binsize > bufsize &&
- fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
+ if (fread(bin + bufsize, binsize - bufsize, 1, fp) == 0) {
binsize = bufsize;
/* The error is reported by mrb_load_irep_buf_cxt() */
}
+ }
result = mrb_load_irep_buf_cxt(mrb, bin, binsize, c);
if (mrb_string_p(bin_obj)) mrb_str_resize(mrb, bin_obj, 0);

parse.y: fix buffer overflow with tweaked mruby binary.