yugui	2010-07-24 19:39:35 +0900 (Sat, 24 Jul 2010)

  New Revision: 28748

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=28748

  Log:
    merges r28728 from trunk into ruby_1_9_2.
    --
    * re.c (rb_reg_expr_str): fixed out-of-boundary access at invalid
      multibyte characters.

  Modified files:
    branches/ruby_1_9_2/ChangeLog
    branches/ruby_1_9_2/re.c

Index: ruby_1_9_2/ChangeLog
===================================================================
--- ruby_1_9_2/ChangeLog	(revision 28747)
+++ ruby_1_9_2/ChangeLog	(revision 28748)
@@ -1,3 +1,8 @@
+Fri Jul 23 09:02:43 2010  Nobuyoshi Nakada  <nobu@r...>
+
+	* re.c (rb_reg_expr_str): fixed out-of-boundary access at invalid
+	  multibyte characters.
+
 Thu Jul 22 16:27:41 2010  NARUSE, Yui  <naruse@r...>
 
 	* re.c (rb_reg_expr_str): fix broken Regexp#inspect when it
Index: ruby_1_9_2/re.c
===================================================================
--- ruby_1_9_2/re.c	(revision 28747)
+++ ruby_1_9_2/re.c	(revision 28748)
@@ -370,18 +370,20 @@
 		rb_str_buf_cat(str, p, clen);
 	    }
 	    else if (c == -1) {
-                int l;
+		clen = rb_enc_precise_mbclen(p, pend, enc);
+		if (!MBCLEN_CHARFOUND_P(clen)) {
+		    c = (unsigned char)*p;
+		    clen = 1;
+		    goto hex;
+		}
 		if (resenc) {
 		    unsigned int c = rb_enc_mbc_to_codepoint(p, pend, enc);
-		    l = rb_enc_codelen(c, enc);
 		    rb_str_buf_cat_escaped_char(str, c, unicode_p);
 		}
 		else {
-		    l = mbclen(p, pend, enc);
-		    rb_str_buf_cat(str, p, l);
+		    clen = MBCLEN_CHARFOUND_LEN(clen);
+		    rb_str_buf_cat(str, p, clen);
 		}
-		p += l;
-		continue;
 	    }
 	    else if (rb_enc_isprint(c, enc)) {
 		rb_str_buf_cat(str, p, clen);
@@ -389,6 +391,7 @@
 	    else if (!rb_enc_isspace(c, enc)) {
 		char b[8];
 
+	      hex:
 		snprintf(b, sizeof(b), "\\x%02X", c);
 		rb_str_buf_cat(str, b, 4);
 	    }

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/