glass	2012-11-03 12:21:47 +0900 (Sat, 03 Nov 2012)

  New Revision: 37438

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=37438

  Log:
    * array.c (recursive_equal): fix not to make invalid pointers when
      self and other are resized to same size in #== of their elements.
      [ruby-dev:46373] [Feature #6177]

  Modified files:
    trunk/ChangeLog
    trunk/array.c

Index: array.c
===================================================================
--- array.c	(revision 37437)
+++ array.c	(revision 37438)
@@ -3269,18 +3269,20 @@
 static VALUE
 recursive_equal(VALUE ary1, VALUE ary2, int recur)
 {
-    long i;
+    long i, len1;
     VALUE *p1, *p2;
 
     if (recur) return Qtrue; /* Subtle! */
 
     p1 = RARRAY_PTR(ary1);
     p2 = RARRAY_PTR(ary2);
+    len1 = RARRAY_LEN(ary1);
 
-    for (i = 0; i < RARRAY_LEN(ary1); i++) {
+    for (i = 0; i < len1; i++) {
 	if (*p1 != *p2) {
 	    if (rb_equal(*p1, *p2)) {
-		if (RARRAY_LEN(ary1) != RARRAY_LEN(ary2))
+		len1 = RARRAY_LEN(ary1);
+		if (len1 != RARRAY_LEN(ary2) || len1 < i)
 		    return Qfalse;
 		p1 = RARRAY_PTR(ary1) + i;
 		p2 = RARRAY_PTR(ary2) + i;
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 37437)
+++ ChangeLog	(revision 37438)
@@ -1,3 +1,9 @@
+Sat Nov  3 12:18:35 2012  Masaki Matsushita  <glass.saga@g...>
+
+	* array.c (recursive_equal): fix not to make invalid pointers when
+	  self and other are resized to same size in #== of their elements.
+	  [ruby-dev:46373] [Feature #6177]
+
 Sat Nov  3 12:06:15 2012  Kouhei Sutou  <kou@c...>
 
 	* test/rexml/test_xml_declaration.rb (TestXmlDeclaration#test_*):

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/