git.iko.soy/text
on master help sign in
Properly fix the int overflow bug reported by Ian

--HG-- extra : convert_revision : 0748b2807e5ea77269050ae6c744df455988a808

commit98252859097c1323d17ffa4bdb14380b05d1fd8c authorBryan O'Sullivan <bos@serpentine.com> dateMon 4 Oct 2010, 02:50 (16 years ago) parent26eab0f
4 files changed+17−3
compare with master
unifiedsplit
Data/Text.hs+2 Data/Text/Array.hs+1−1 tests/Regressions.hs+13−1 text.cabal+1−1
Data/Text.hs+2
@@ -807,6 +807,8 @@ replicate n t@(Text a o l)
807807 | n <= 0 || l <= 0 = empty
808808 | n == 1 = t
809809 | isSingleton t = replicateChar n (unsafeHead t)
810+ | len < n = error $ "Data.Text.replicate: invalid length " ++
811+ show n -- multiplication overflow
810812 | otherwise = Text (A.run x) 0 len
811813 where
812814 len = l * n
Data/Text/Array.hs+1−1
@@ -103,7 +103,7 @@ instance IArray (MArray s) where
103103-- | Create an uninitialized mutable array.
104104new :: forall s. Int -> ST s (MArray s)
105105new n
106− | len < 0 = error $ "Data.Text.Array.unsafeNew: invalid length " ++ show n
106+ | len < n = error $ "Data.Text.Array.unsafeNew: invalid length " ++ show n
107107 | otherwise = ST $ \s1# ->
108108 case newByteArray# len# s1# of
109109 (# s2#, marr# #) -> (# s2#, MArray marr#
tests/Regressions.hs+13−1
@@ -1,4 +1,4 @@
1−{-# LANGUAGE ScopedTypeVariables #-}
1+{-# LANGUAGE OverloadedStrings, ScopedTypeVariables #-}
22
33-- Regression tests for specific bugs.
44
@@ -6,6 +6,7 @@ import Control.Exception (SomeException, handle)
66import System.IO
77import qualified Data.ByteString as B
88import qualified Data.ByteString.Lazy as LB
9+import qualified Data.Text as T
910import qualified Data.Text.IO as T
1011import qualified Data.Text.Lazy as LT
1112import qualified Data.Text.Lazy.Encoding as LE
@@ -30,10 +31,21 @@ hGetContents_crash = withTempFile $ \ path h -> do
3031 handle (\(_::SomeException) -> return ()) $
3132 T.hGetContents h' >> assertFailure "T.hGetContents should crash"
3233
34+-- Reported by Ian Lynagh: attempting to allocate a sufficiently large
35+-- string (via either Array.new or Text.replicate) could result in an
36+-- integer overflow.
37+replicate_crash = handle (\(_::SomeException) -> return ()) $
38+ T.replicate (2^power) "0123456789abcdef" `seq`
39+ assertFailure "T.replicate should crash"
40+ where
41+ power | maxBound == (2147483647::Int) = 28
42+ | otherwise = 60 :: Int
43+
3344tests :: F.Test
3445tests = F.testGroup "crashers" [
3546 F.testCase "hGetContents_crash" hGetContents_crash
3647 , F.testCase "lazy_encode_crash" lazy_encode_crash
48+ , F.testCase "replicate_crash" replicate_crash
3749 ]
3850
3951main = F.defaultMain [tests]
text.cabal+1−1
@@ -1,5 +1,5 @@
11name: text
2−version: 0.9.0.2
2+version: 0.9.0.1
33homepage: http://code.haskell.org/text
44synopsis: An efficient packed Unicode text type.
55description: