@@ -1688,7 +1688,10 @@ io_unget_data(mrb_state *mrb, struct mrb_io *fptr, const char *ptr, mrb_int len)
|
1688 | 1688 | if (len > SHRT_MAX) { |
1689 | 1689 | mrb_raise(mrb, E_ARGUMENT_ERROR, "string too long to ungetc"); |
1690 | 1690 | } |
1691 | | -if (len > MRB_IO_BUF_SIZE - buf->len) { |
| 1691 | +if (buf->len + len > SHRT_MAX) { |
| 1692 | +mrb_raise(mrb, E_ARGUMENT_ERROR, "total ungetc buffer exceeds maximum size"); |
| 1693 | + } |
| 1694 | +if (buf->len + len > MRB_IO_BUF_SIZE) { |
1692 | 1695 | fptr->buf = (struct mrb_io_buf*)mrb_realloc(mrb, buf, sizeof(struct mrb_io_buf)+buf->len+len-MRB_IO_BUF_SIZE); |
1693 | 1696 | buf = fptr->buf; |
1694 | 1697 | } |
|