nobu	2014-09-10 17:05:12 +0900 (Wed, 10 Sep 2014)

  New Revision: 47512

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=47512

  Log:
    variable.c: check index overflow
    
    * variable.c (rb_ivar_set), vm_insnhelper.c (vm_setivar): check
      instance variable index overflow.

  Modified files:
    trunk/variable.c
    trunk/vm_insnhelper.c
Index: variable.c
===================================================================
--- variable.c	(revision 47511)
+++ variable.c	(revision 47512)
@@ -1153,6 +1153,7 @@ rb_ivar_set(VALUE obj, ID id, VALUE val) https://github.com/ruby/ruby/blob/trunk/variable.c#L1153
         ivar_extended = 0;
         if (!st_lookup(iv_index_tbl, (st_data_t)id, &index)) {
             index = iv_index_tbl->num_entries;
+	    if (index >= INT_MAX) rb_raise(rb_eArgError, "too many instance variables");
             st_add_direct(iv_index_tbl, (st_data_t)id, index);
             ivar_extended = 1;
         }
Index: vm_insnhelper.c
===================================================================
--- vm_insnhelper.c	(revision 47511)
+++ vm_insnhelper.c	(revision 47512)
@@ -570,8 +570,11 @@ vm_setivar(VALUE obj, ID id, VALUE val, https://github.com/ruby/ruby/blob/trunk/vm_insnhelper.c#L570
 		    ic->ic_value.index = index;
 		    ic->ic_serial = RCLASS_SERIAL(klass);
 		}
+		else if (index >= INT_MAX) {
+		    rb_raise(rb_eArgError, "too many instance variables");
+		}
 		else {
-		    ci->aux.index = index + 1;
+		    ci->aux.index = (int)(index + 1);
 		}
 	    }
 	    /* fall through */

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/