naruse	2012-02-25 16:20:00 +0900 (Sat, 25 Feb 2012)

  New Revision: 34803

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=34803

  Log:
    * complex.c (nucomp_marshal_load): raise error on invalid data.
      reported by John Firebaugh [ruby-core:42860] [Bug #6076]

  Modified files:
    trunk/ChangeLog
    trunk/complex.c
    trunk/rational.c
    trunk/test/ruby/test_marshal.rb

Index: complex.c
===================================================================
--- complex.c	(revision 34802)
+++ complex.c	(revision 34803)
@@ -1260,6 +1260,8 @@
 {
     get_dat1(self);
     Check_Type(a, T_ARRAY);
+    if (RARRAY_LEN(a) != 2)
+	rb_raise(rb_eArgError, "marshaled complex must have an array whose length is 2 but %ld", RARRAY_LEN(a));
     dat->real = RARRAY_PTR(a)[0];
     dat->imag = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 34802)
+++ ChangeLog	(revision 34803)
@@ -1,3 +1,8 @@
+Sat Feb 25 16:18:24 2012  NARUSE, Yui  <naruse@r...>
+
+	* complex.c (nucomp_marshal_load): raise error on invalid data.
+	  reported by John Firebaugh [ruby-core:42860] [Bug #6076]
+
 Sat Feb 25 14:46:54 2012  Nobuyoshi Nakada  <nobu@r...>
 
 	* ext/dl/dl.c (Init_dl): support intrinsic types, size_t, ptrdiff_t
Index: test/ruby/test_marshal.rb
===================================================================
--- test/ruby/test_marshal.rb	(revision 34802)
+++ test/ruby/test_marshal.rb	(revision 34803)
@@ -469,4 +469,18 @@
     assert_equal(o1.class, o2.class)
     assert_equal(o1.foo, o2.foo)
   end
+
+  def test_marshal_complex
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\x05")}
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\x06i\x00")}
+    assert_equal(Complex(1, 2), Marshal.load("\x04\bU:\fComplex[\ai\x06i\a"))
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\bi\x00i\x00i\x00")}
+  end
+
+  def test_marshal_rational
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\x05")}
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\x06i\x00")}
+    assert_equal(Rational(1, 2), Marshal.load("\x04\bU:\rRational[\ai\x06i\a"))
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\bi\x00i\x00i\x00")}
+  end
 end
Index: rational.c
===================================================================
--- rational.c	(revision 34802)
+++ rational.c	(revision 34803)
@@ -1606,6 +1606,8 @@
 {
     get_dat1(self);
     Check_Type(a, T_ARRAY);
+    if (RARRAY_LEN(a) != 2)
+	rb_raise(rb_eArgError, "marshaled rational must have an array whose length is 2 but %ld", RARRAY_LEN(a));
     dat->num = RARRAY_PTR(a)[0];
     dat->den = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/