Prevent int overflow causing infinite loop in buf resizing

brianmario · May 26, 2022 · e8de283 · e8de283
1 parent 8971009
commit e8de283
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/ext/yajl/yajl_buf.c b/ext/yajl/yajl_buf.c
@@ -116,10 +116,10 @@ yajl_buf_state yajl_buf_ensure_available(yajl_buf buf, unsigned int want)
 
     need = buf->len;
 
-    while (want >= (need - buf->used)) need <<= 1;
+    while (want >= (need - buf->used) && need > 0) need <<= 1;
 
     // Check for overflow
-    if (need < buf->used) {
+    if (need < buf->used || need == 0) {
         return yajl_buf_set_error(buf, yajl_buf_overflow);
     }
 

diff --git a/lib/yajl/version.rb b/lib/yajl/version.rb
@@ -1,3 +1,3 @@
 module Yajl
-  VERSION = '1.4.2'
+  VERSION = '1.4.3'
 end