mame	2019-01-15 23:19:19 +0900 (Tue, 15 Jan 2019)

  New Revision: 66832

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=66832

  Log:
    st.c (rb_hash_bulk_insert_into_st_table): avoid out-of-bounds write
    
    "hash_bulk_insert" first expands the table, but the target size was
    wrong: it was calculated by "num_entries + (size to buld insert)", but
    it was wrong when "num_entries < entries_bound", i.e., it has a deleted
    entry.  "hash_bulk_insert" adds the given entries from entries_bound,
    which led to out-of-bounds write access.  [Bug #15536]
    
    As a simple fix, this commit changes the calculation to "entries_bound +
    size".  I'm afraid if this might be inefficient, but I think it is safe
    anyway.

  Modified files:
    trunk/bootstraptest/test_literal.rb
    trunk/st.c
Index: st.c
===================================================================
--- st.c	(revision 66831)
+++ st.c	(revision 66832)
@@ -2299,7 +2299,7 @@ rb_hash_bulk_insert_into_st_table(long a https://github.com/ruby/ruby/blob/trunk/st.c#L2299
     st_table *tab = RHASH_ST_TABLE(hash);
 
     tab = RHASH_TBL_RAW(hash);
-    n = tab->num_entries + size;
+    n = tab->entries_bound + size;
     st_expand_table(tab, n);
     if (UNLIKELY(tab->num_entries))
         st_insert_generic(tab, argc, argv, hash);
Index: bootstraptest/test_literal.rb
===================================================================
--- bootstraptest/test_literal.rb	(revision 66831)
+++ bootstraptest/test_literal.rb	(revision 66832)
@@ -223,6 +223,24 @@ assert_equal 'ok', %q{ #  long hash lite https://github.com/ruby/ruby/blob/trunk/bootstraptest/test_literal.rb#L223
   :ok
 }
 
+assert_equal 'ok', %q{ #  Bug #15536
+  eval <<-END
+    {
+      **{
+        a0: nil, a1: nil, a2: nil, a3: nil, a4: nil, a5: nil, a6: nil, a7: nil, a8: nil,
+      },
+      a0: nil, a1: nil, a2: nil, a3: nil, a4: nil, a5: nil, a6: nil, a7: nil, a8: nil,
+      **{
+        c: nil
+      },
+      b0: nil, b1: nil, b2: nil, b3: nil, b4: nil, b5: nil, b6: nil, b7: nil, b8: nil,
+      b9: nil, b10: nil, b11: nil, b12: nil, b13: nil, b14: nil, b15: nil, b16: nil,
+      b17: nil, b18: nil, b19: nil, b20: nil, b21: nil,
+    }
+  END
+  :ok
+}
+
 assert_equal 'ok', %q{
   [print(:ok), exit] # void literal with side-effect
   :dummy

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/