nobu	2016-06-19 11:19:45 +0900 (Sun, 19 Jun 2016)

  New Revision: 55449

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=55449

  Log:
    variable.c: consider length
    
    * variable.c (rb_path_to_class): consider the string length
      instead of a terminator.

  Modified files:
    trunk/ChangeLog
    trunk/test/ruby/test_marshal.rb
    trunk/variable.c
Index: test/ruby/test_marshal.rb
===================================================================
--- test/ruby/test_marshal.rb	(revision 55448)
+++ test/ruby/test_marshal.rb	(revision 55449)
@@ -719,10 +719,12 @@ class TestMarshal < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_marshal.rb#L719
   end
 
   def test_marshal_load_extended_class_crash
-    crash = "\x04\be:\x0F\x00omparableo:\vObject\x00"
-
-    opt = %w[--disable=gems]
-    assert_ruby_status(opt, "Marshal.load(#{crash.dump})")
+    assert_separately([], "#{<<-"begin;"}\n#{<<-"end;"}")
+    begin;
+      assert_raise_with_message(ArgumentError, /undefined/) do
+        Marshal.load("\x04\be:\x0F\x00omparableo:\vObject\x00")
+      end
+    end;
   end
 
   def test_marshal_load_r_prepare_reference_crash
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 55448)
+++ ChangeLog	(revision 55449)
@@ -1,4 +1,7 @@ https://github.com/ruby/ruby/blob/trunk/ChangeLog#L1
-Sun Jun 19 10:54:40 2016  Nobuyoshi Nakada  <nobu@r...>
+Sun Jun 19 11:19:43 2016  Nobuyoshi Nakada  <nobu@r...>
+
+	* variable.c (rb_path_to_class): consider the string length
+	  instead of a terminator.
 
 	* variable.c (rb_path_to_class): search the constant at once
 	  instead of checking if defined and then getting it.
Index: variable.c
===================================================================
--- variable.c	(revision 55448)
+++ variable.c	(revision 55449)
@@ -389,7 +389,7 @@ VALUE https://github.com/ruby/ruby/blob/trunk/variable.c#L389
 rb_path_to_class(VALUE pathname)
 {
     rb_encoding *enc = rb_enc_get(pathname);
-    const char *pbeg, *p, *path = RSTRING_PTR(pathname);
+    const char *pbeg, *pend, *p, *path = RSTRING_PTR(pathname);
     ID id;
     VALUE c = rb_cObject;
 
@@ -397,15 +397,16 @@ rb_path_to_class(VALUE pathname) https://github.com/ruby/ruby/blob/trunk/variable.c#L397
 	rb_raise(rb_eArgError, "invalid class path encoding (non ASCII)");
     }
     pbeg = p = path;
-    if (path[0] == '#') {
+    pend = path + RSTRING_LEN(pathname);
+    if (path == pend || path[0] == '#') {
 	rb_raise(rb_eArgError, "can't retrieve anonymous class %"PRIsVALUE,
 		 QUOTE(pathname));
     }
-    while (*p) {
-	while (*p && *p != ':') p++;
+    while (p < pend) {
+	while (p < pend && *p != ':') p++;
 	id = rb_check_id_cstr(pbeg, p-pbeg, enc);
-	if (p[0] == ':') {
-	    if (p[1] != ':') goto undefined_class;
+	if (p < pend && p[0] == ':') {
+	    if ((size_t)(pend - p) < 2 || p[1] != ':') goto undefined_class;
 	    p += 2;
 	    pbeg = p;
 	}

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/