nobu	2013-09-24 17:39:01 +0900 (Tue, 24 Sep 2013)

  New Revision: 43035

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=43035

  Log:
    string.c: fix for UTF-16/32
    
    * string.c (rb_str_inspect): get rid of out-of-bound access.
    * string.c (rb_str_inspect): when a UTF-16/32 string doesn't have a
      BOM, inspect as a dummy encoding string.

  Modified files:
    trunk/ChangeLog
    trunk/string.c
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 43034)
+++ ChangeLog	(revision 43035)
@@ -1,3 +1,10 @@ https://github.com/ruby/ruby/blob/trunk/ChangeLog#L1
+Tue Sep 24 17:38:56 2013  Nobuyoshi Nakada  <nobu@r...>
+
+	* string.c (rb_str_inspect): get rid of out-of-bound access.
+
+	* string.c (rb_str_inspect): when a UTF-16/32 string doesn't have a
+	  BOM, inspect as a dummy encoding string.
+
 Tue Sep 24 17:15:10 2013  Nobuyoshi Nakada  <nobu@r...>
 
 	* enc/encdb.c (ENC_DUMMY_UNICODE): make BOM-encodings dummy.
Index: string.c
===================================================================
--- string.c	(revision 43034)
+++ string.c	(revision 43035)
@@ -4735,23 +4735,27 @@ rb_str_inspect(VALUE str) https://github.com/ruby/ruby/blob/trunk/string.c#L4735
 
     p = RSTRING_PTR(str); pend = RSTRING_END(str);
     prev = p;
-    if (encidx == ENCINDEX_UTF_16) {
+    if (encidx == ENCINDEX_UTF_16 && p + 2 <= pend) {
 	const unsigned char *q = (const unsigned char *)p;
 	if (q[0] == 0xFE && q[1] == 0xFF)
 	    enc = rb_enc_from_index(ENCINDEX_UTF_16BE);
 	else if (q[0] == 0xFF && q[1] == 0xFE)
 	    enc = rb_enc_from_index(ENCINDEX_UTF_16LE);
-	else
+	else {
+	    enc = rb_ascii8bit_encoding();
 	    unicode_p = 0;
+	}
     }
-    else if (encidx == ENCINDEX_UTF_32) {
+    else if (encidx == ENCINDEX_UTF_32 && p + 4 <= pend) {
 	const unsigned char *q = (const unsigned char *)p;
 	if (q[0] == 0 && q[1] == 0 && q[2] == 0xFE && q[3] == 0xFF)
 	    enc = rb_enc_from_index(ENCINDEX_UTF_32BE);
 	else if (q[3] == 0 && q[2] == 0 && q[1] == 0xFE && q[0] == 0xFF)
 	    enc = rb_enc_from_index(ENCINDEX_UTF_32LE);
-	else
+	else {
+	    enc = rb_ascii8bit_encoding();
 	    unicode_p = 0;
+	}
     }
     while (p < pend) {
 	unsigned int c, cc;

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/