[ruby-dev:38508] overflow on LP64

なかだです。

ときどき、longからintに暗黙のうちに変換しているところがあります。
ほとんどのところは型を合わせるだけでもすむのですが、たとえば
RARRAY_LEN()などからrb_funcall()などを呼び出している場合、実行時
にオーバーフローが起きる可能性があります。

安全にlong->intのキャストを行う関数を追加するのがいいのではない
安全にlong->かと思います。


Index: numeric.c
===================================================================
--- numeric.c	(revision 23498)
+++ numeric.c	(working copy)
@@ -1719,4 +1719,14 @@ rb_fix2int(VALUE val)
 #endif
 
+#undef rb_long2int
+int
+rb_long2int(long n)
+{
+#if SIZEOF_INT < SIZEOF_LONG
+    check_int(n);
+#endif
+    return (int)n;
+}
+
 VALUE
 rb_num2fix(VALUE val)
Index: struct.c
===================================================================
--- struct.c	(revision 23499)
+++ struct.c	(working copy)
@@ -379,5 +379,5 @@ VALUE
 rb_struct_initialize(VALUE self, VALUE values)
 {
-    return rb_struct_initialize_m(RARRAY_LEN(values), RARRAY_PTR(values), self);
+    return rb_struct_initialize_m(RARRAY_LENINT(values), RARRAY_PTR(values), self);
 }
 
@@ -415,8 +415,8 @@ rb_struct_new(VALUE klass, ...)
 {
     VALUE tmpargs[N_REF_FUNC], *mem = tmpargs;
-    long size, i;
+    int size, i;
     va_list args;
 
-    size = num_members(klass);
+    size = rb_long2int(num_members(klass));
     if (size > numberof(tmpargs)) {
 	tmpargs[0] = rb_ary_tmp_new(size);
Index: vm_eval.c
===================================================================
--- vm_eval.c	(revision 23498)
+++ vm_eval.c	(working copy)
@@ -399,5 +399,5 @@ rb_apply(VALUE recv, ID mid, VALUE args)
     VALUE *argv;
 
-    argc = RARRAY_LEN(args);	/* Assigns LONG, but argc is INT */
+    argc = RARRAY_LENINT(args);
     argv = ALLOCA_N(VALUE, argc);
     MEMCPY(argv, RARRAY_PTR(args), VALUE, argc);
@@ -553,5 +553,5 @@ rb_yield_splat(VALUE values)
         rb_raise(rb_eArgError, "not an array");
     }
-    v = rb_yield_0(RARRAY_LEN(tmp), RARRAY_PTR(tmp));
+    v = rb_yield_0(RARRAY_LENINT(tmp), RARRAY_PTR(tmp));
     return v;
 }
@@ -910,5 +910,5 @@ rb_eval_cmd(VALUE cmd, VALUE arg, int le
 	rb_set_safe_level_force(level);
 	if ((state = EXEC_TAG()) == 0) {
-	    val = rb_funcall2(cmd, rb_intern("call"), RARRAY_LEN(arg),
+	    val = rb_funcall2(cmd, rb_intern("call"), RARRAY_LENINT(arg),
 			      RARRAY_PTR(arg));
 	}
@@ -952,5 +952,5 @@ yield_under(VALUE under, VALUE self, VAL
     }
     else {
-	return vm_yield_with_cref(th, RARRAY_LEN(values), RARRAY_PTR(values), cref);
+	return vm_yield_with_cref(th, RARRAY_LENINT(values), RARRAY_PTR(values), cref);
     }
 }
Index: vm_insnhelper.c
===================================================================
--- vm_insnhelper.c	(revision 23498)
+++ vm_insnhelper.c	(working copy)
@@ -775,5 +775,5 @@ vm_yield_setup_block_args(rb_thread_t *t
             (m + iseq->arg_post_len) > 0 &&    /* this process is meaningful */
             argc == 1 && !NIL_P(ary = rb_check_array_type(argv[0]))) { /* rhs is only an array */
-        th->mark_stack_len = argc = RARRAY_LEN(ary);
+        th->mark_stack_len = argc = RARRAY_LENINT(ary);
 
         CHECK_STACK_OVERFLOW(th->cfp, argc);
Index: include/ruby/ruby.h
===================================================================
--- include/ruby/ruby.h	(revision 23498)
+++ include/ruby/ruby.h	(working copy)
@@ -664,4 +664,11 @@ struct RArray {
      RARRAY(a)->as.heap.ptr)
 
+#if SIZEOF_LONG > SIZEOF_INT
+int rb_long2int(long);
+#else
+#define rb_long2int(n) (int)(n)
+#endif
+#define RARRAY_LENINT(ary) rb_long2int(RARRAY_LEN(ary))
+
 struct RRegexp {
     struct RBasic basic;


-- 
--- 僕の前にBugはない。
--- 僕の後ろにBugはできる。
    中田 伸悦