[ruby/erb] Fix integer overflow

Fix ruby/erb#87

ruby/erb@75764f022b

Author: nobu

ext/erb/escape/escape.c

@@ -49,7 +49,7 @@ optimized_escape_html(VALUE str)
         const unsigned char c = *cstr++;
         uint8_t len = html_escape_table[c].len;
         if (len) {
-            uint16_t segment_len = cstr - segment_start - 1;
+            size_t segment_len = cstr - segment_start - 1;
             if (!buf) {
                 buf = ALLOCV_N(char, vbuf, escaped_length(str));
                 dest = buf;
@@ -64,7 +64,7 @@ optimized_escape_html(VALUE str)
         }
     }
     if (buf) {
-        uint16_t segment_len = cstr - segment_start;
+        size_t segment_len = cstr - segment_start;
         if (segment_len) {
             memcpy(dest, segment_start, segment_len);
             dest += segment_len;

test/erb/test_erb.rb

@@ -77,6 +77,9 @@ def test_html_escape
 
     assert_equal("", ERB::Util.html_escape(nil))
     assert_equal("123", ERB::Util.html_escape(123))
+
+    assert_equal(65536+5, ERB::Util.html_escape("x"*65536 + "&").size)
+    assert_equal(65536+5, ERB::Util.html_escape("&" + "x"*65536).size)
   end
 
   def test_html_escape_to_s