Skip to content

Commit 76732bb

Browse files
committed
Change StringValuePtr to StringValueCStr
StringValuePtr doesn't guarantee a NULL byte at the end of the char * it returns. The for loop in the `parse_version_number` depends on a NULL byte in the string in order to stop the loop. Since `StringValuePtr` doesn't guarantee a NULL byte in the `char *`, it's possible the for loop could read past the end of the string, and `offset` would end up being larger than the number of bytes that are actually in the string.
1 parent 433ebd3 commit 76732bb

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

ext/version_sorter/version_sorter.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ rb_version_sort_1(VALUE rb_self, VALUE rb_version_array, compare_callback_t cmp)
193193
else
194194
rb_version_string = rb_version;
195195

196-
versions[i] = parse_version_number(StringValuePtr(rb_version_string));
196+
versions[i] = parse_version_number(StringValueCStr(rb_version_string));
197197
versions[i]->rb_version = rb_version;
198198
}
199199

@@ -235,8 +235,8 @@ rb_version_sort_r_bang(VALUE rb_self, VALUE rb_versions)
235235
static VALUE
236236
rb_version_compare(VALUE rb_self, VALUE rb_version_a, VALUE rb_version_b)
237237
{
238-
struct version_number *version_a = parse_version_number(StringValuePtr(rb_version_a));
239-
struct version_number *version_b = parse_version_number(StringValuePtr(rb_version_b));
238+
struct version_number *version_a = parse_version_number(StringValueCStr(rb_version_a));
239+
struct version_number *version_b = parse_version_number(StringValueCStr(rb_version_b));
240240
return INT2NUM(version_compare_cb(&version_a, &version_b));
241241
}
242242

0 commit comments

Comments
 (0)