Patch CVE-2013-4164

Charlie Somerville · Charlie Somerville · commit e1c0c3f3923f · 2013-11-22T12:31:46.000-08:00
diff --git a/util.c b/util.c
@@ -853,6 +853,12 @@ extern void *MALLOC(size_t);
 #define MALLOC malloc
 #endif
 
+#ifdef FREE
+extern void FREE(void*);
+#else
+#define FREE free
+#endif
+
 #ifndef Omit_Private_Memory
 #ifndef PRIVATE_MEM
 #define PRIVATE_MEM 2304
@@ -1142,7 +1148,7 @@ Balloc(int k)
 #endif
 
     ACQUIRE_DTOA_LOCK(0);
-    if ((rv = freelist[k]) != 0) {
+    if (k <= Kmax && (rv = freelist[k]) != 0) {
         freelist[k] = rv->next;
     }
     else {
@@ -1171,6 +1177,10 @@ static void
 Bfree(Bigint *v)
 {
     if (v) {
+        if (v->k > Kmax) {
+            FREE(v);
+            return;
+        }
         ACQUIRE_DTOA_LOCK(0);
         v->next = freelist[v->k];
         freelist[v->k] = v;
@@ -2231,6 +2241,7 @@ ruby_strtod(const char *s00, char **se)
         for (; c >= '0' && c <= '9'; c = *++s) {
 have_dig:
             nz++;
+            if (nf > DBL_DIG * 2) continue;
             if (c -= '0') {
                 nf += nz;
                 for (i = 1; i < nz; i++)
