Fixes #3792. Missing String bounds checks

jruby · May 23, 2017 · 800dee2 · 800dee2
1 parent adb3127
commit 800dee2
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/core/src/main/java/org/jruby/RubyString.java b/core/src/main/java/org/jruby/RubyString.java
@@ -1143,6 +1143,10 @@ public IRubyObject op_plus(ThreadContext context, IRubyObject arg) {
     public IRubyObject op_plus19(ThreadContext context, IRubyObject arg) {
         RubyString str = arg.convertToString();
         Encoding enc = checkEncoding(str);
+        long len = (long) value.getRealSize() + str.value.getRealSize();
+
+        // we limit to int because ByteBuffer can only allocate int sizes
+        if (len > Integer.MAX_VALUE) throw context.runtime.newArgumentError("argument too big");
         RubyString resultStr = newStringNoCopy(context.runtime, StringSupport.addByteLists(value, str.value),
                 enc, CodeRangeSupport.codeRangeAnd(getCodeRange(), str.getCodeRange()));
         resultStr.infectBy(flags | str.flags);