nagachika	2015-12-16 21:11:34 +0900 (Wed, 16 Dec 2015)

  New Revision: 53154

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=53154

  Log:
    merge revision(s) 53153:
    
    * ext/fiddle/handle.c: check tainted string arguments.
      Patch provided by tenderlove and nobu.
    
    * test/fiddle/test_handle.rb (class TestHandle): add test for above.

  Modified directories:
    branches/ruby_2_2/
  Modified files:
    branches/ruby_2_2/ChangeLog
    branches/ruby_2_2/ext/fiddle/handle.c
    branches/ruby_2_2/test/fiddle/test_handle.rb
    branches/ruby_2_2/version.h
Index: ruby_2_2/ChangeLog
===================================================================
--- ruby_2_2/ChangeLog	(revision 53153)
+++ ruby_2_2/ChangeLog	(revision 53154)
@@ -1,3 +1,11 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ChangeLog#L1
+Wed Dec 16 21:10:19 2015  CHIKANAGA Tomoyuki  <nagachika@r...>
+
+	* ext/fiddle/handle.c: check tainted string arguments.
+	  Patch provided by tenderlove and nobu.
+
+	* test/fiddle/test_handle.rb (class TestHandle): add test for above.
+
+
 Wed Dec 16 02:38:19 2015  Nobuyoshi Nakada  <nobu@r...>
 
 	* io.c (parse_mode_enc): fix buffer overflow.
Index: ruby_2_2/ext/fiddle/handle.c
===================================================================
--- ruby_2_2/ext/fiddle/handle.c	(revision 53153)
+++ ruby_2_2/ext/fiddle/handle.c	(revision 53154)
@@ -1,6 +1,8 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/fiddle/handle.c#L1
 #include <ruby.h>
 #include <fiddle.h>
 
+#define SafeStringValueCStr(v) (rb_check_safe_obj(rb_string_value(&v)), StringValueCStr(v))
+
 VALUE rb_cHandle;
 
 struct dl_handle {
@@ -143,11 +145,11 @@ rb_fiddle_handle_initialize(int argc, VA https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/fiddle/handle.c#L145
 	cflag = RTLD_LAZY | RTLD_GLOBAL;
 	break;
       case 1:
-	clib = NIL_P(lib) ? NULL : StringValuePtr(lib);
+	clib = NIL_P(lib) ? NULL : SafeStringValueCStr(lib);
 	cflag = RTLD_LAZY | RTLD_GLOBAL;
 	break;
       case 2:
-	clib = NIL_P(lib) ? NULL : StringValuePtr(lib);
+	clib = NIL_P(lib) ? NULL : SafeStringValueCStr(lib);
 	cflag = NUM2INT(flag);
 	break;
       default:
@@ -264,7 +266,7 @@ rb_fiddle_handle_to_i(VALUE self) https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/fiddle/handle.c#L266
     return PTR2NUM(fiddle_handle);
 }
 
-static VALUE fiddle_handle_sym(void *handle, const char *symbol);
+static VALUE fiddle_handle_sym(void *handle, VALUE symbol);
 
 /*
  * Document-method: sym
@@ -283,7 +285,7 @@ rb_fiddle_handle_sym(VALUE self, VALUE s https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/fiddle/handle.c#L285
 	rb_raise(rb_eFiddleError, "closed handle");
     }
 
-    return fiddle_handle_sym(fiddle_handle->ptr, StringValueCStr(sym));
+    return fiddle_handle_sym(fiddle_handle->ptr, sym);
 }
 
 #ifndef RTLD_NEXT
@@ -306,11 +308,11 @@ rb_fiddle_handle_sym(VALUE self, VALUE s https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/fiddle/handle.c#L308
 static VALUE
 rb_fiddle_handle_s_sym(VALUE self, VALUE sym)
 {
-    return fiddle_handle_sym(RTLD_NEXT, StringValueCStr(sym));
+    return fiddle_handle_sym(RTLD_NEXT, sym);
 }
 
 static VALUE
-fiddle_handle_sym(void *handle, const char *name)
+fiddle_handle_sym(void *handle, VALUE symbol)
 {
 #if defined(HAVE_DLERROR)
     const char *err;
@@ -319,6 +321,7 @@ fiddle_handle_sym(void *handle, const ch https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/fiddle/handle.c#L321
 # define CHECK_DLERROR
 #endif
     void (*func)();
+    const char *name = SafeStringValueCStr(symbol);
 
     rb_secure(2);
 #ifdef HAVE_DLERROR
@@ -368,7 +371,7 @@ fiddle_handle_sym(void *handle, const ch https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/fiddle/handle.c#L371
     }
 #endif
     if( !func ){
-	rb_raise(rb_eFiddleError, "unknown symbol \"%s\"", name);
+	rb_raise(rb_eFiddleError, "unknown symbol \"%"PRIsVALUE"\"", symbol);
     }
 
     return PTR2NUM(func);
Index: ruby_2_2/version.h
===================================================================
--- ruby_2_2/version.h	(revision 53153)
+++ ruby_2_2/version.h	(revision 53154)
@@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/version.h#L1
 #define RUBY_VERSION "2.2.4"
 #define RUBY_RELEASE_DATE "2015-12-16"
-#define RUBY_PATCHLEVEL 229
+#define RUBY_PATCHLEVEL 230
 
 #define RUBY_RELEASE_YEAR 2015
 #define RUBY_RELEASE_MONTH 12
Index: ruby_2_2/test/fiddle/test_handle.rb
===================================================================
--- ruby_2_2/test/fiddle/test_handle.rb	(revision 53153)
+++ ruby_2_2/test/fiddle/test_handle.rb	(revision 53154)
@@ -9,6 +9,23 @@ module Fiddle https://github.com/ruby/ruby/blob/trunk/ruby_2_2/test/fiddle/test_handle.rb#L9
 
     include Test::Unit::Assertions
 
+    def test_safe_handle_open
+      t = Thread.new do
+        $SAFE = 1
+        Fiddle::Handle.new(LIBC_SO.taint)
+      end
+      assert_raise(SecurityError) { t.value }
+    end
+
+    def test_safe_function_lookup
+      t = Thread.new do
+        h = Fiddle::Handle.new(LIBC_SO)
+        $SAFE = 1
+        h["qsort".taint]
+      end
+      assert_raise(SecurityError) { t.value }
+    end
+
     def test_to_i
       handle = Fiddle::Handle.new(LIBC_SO)
       assert_kind_of Integer, handle.to_i

Property changes on: ruby_2_2
___________________________________________________________________
Modified: svn:mergeinfo
   Merged /trunk:r53153


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/