ruby-changes:28680
From: usa <ko1@a...>
Date: Tue, 14 May 2013 20:27:20 +0900 (JST)
Subject: [ruby-changes:28680] usa:r40732 (ruby_1_9_3): merge revision(s) 40728:
usa 2013-05-14 20:27:08 +0900 (Tue, 14 May 2013) New Revision: 40732 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=40732 Log: merge revision(s) 40728: * ext/dl/lib/dl/func.rb (DL::Function#call): check tainted when $SAFE > 0. * ext/fiddle/function.c (function_call): check tainted when $SAFE > 0. * test/fiddle/test_func.rb (module Fiddle): add test for above. Modified directories: branches/ruby_1_9_3/ Modified files: branches/ruby_1_9_3/ChangeLog branches/ruby_1_9_3/ext/dl/lib/dl/func.rb branches/ruby_1_9_3/ext/fiddle/function.c branches/ruby_1_9_3/version.h Index: ruby_1_9_3/ChangeLog =================================================================== --- ruby_1_9_3/ChangeLog (revision 40731) +++ ruby_1_9_3/ChangeLog (revision 40732) @@ -1,3 +1,11 @@ https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/ChangeLog#L1 +Tue May 14 20:25:58 2013 CHIKANAGA Tomoyuki <nagachika@r...> + + * ext/dl/lib/dl/func.rb (DL::Function#call): check tainted when + $SAFE > 0. + * ext/fiddle/function.c (function_call): check tainted when $SAFE > 0. + * test/fiddle/test_func.rb (module Fiddle): add test for above. + + Tue May 14 11:36:22 2013 Shugo Maeda <shugo@r...> * lib/net/imap.rb (getacl_response): parse the mailbox of an ACL Index: ruby_1_9_3/ext/dl/lib/dl/func.rb =================================================================== --- ruby_1_9_3/ext/dl/lib/dl/func.rb (revision 40731) +++ ruby_1_9_3/ext/dl/lib/dl/func.rb (revision 40732) @@ -92,6 +92,9 @@ module DL https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/ext/dl/lib/dl/func.rb#L92 super else funcs = [] + if $SAFE >= 1 && args.any? { |x| x.tainted? } + raise SecurityError, "tainted parameter not allowed" + end _args = wrap_args(args, @stack.types, funcs, &block) r = @cfunc.call(@stack.pack(_args)) funcs.each{|f| f.unbind_at_call()} Index: ruby_1_9_3/ext/fiddle/function.c =================================================================== --- ruby_1_9_3/ext/fiddle/function.c (revision 40731) +++ ruby_1_9_3/ext/fiddle/function.c (revision 40732) @@ -101,6 +101,15 @@ function_call(int argc, VALUE argv[], VA https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/ext/fiddle/function.c#L101 TypedData_Get_Struct(self, ffi_cif, &function_data_type, cif); + if (rb_safe_level() >= 1) { + for (i = 0; i < argc; i++) { + VALUE src = argv[i]; + if (OBJ_TAINTED(src)) { + rb_raise(rb_eSecurityError, "tainted parameter not allowed"); + } + } + } + values = xcalloc((size_t)argc + 1, (size_t)sizeof(void *)); generic_args = xcalloc((size_t)argc, (size_t)sizeof(fiddle_generic)); Index: ruby_1_9_3/version.h =================================================================== --- ruby_1_9_3/version.h (revision 40731) +++ ruby_1_9_3/version.h (revision 40732) @@ -1,5 +1,5 @@ https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/version.h#L1 #define RUBY_VERSION "1.9.3" -#define RUBY_PATCHLEVEL 425 +#define RUBY_PATCHLEVEL 426 #define RUBY_RELEASE_DATE "2013-05-14" #define RUBY_RELEASE_YEAR 2013 Property changes on: ruby_1_9_3 ___________________________________________________________________ Modified: svn:mergeinfo Merged /trunk:r40728 -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/