usa	2016-12-27 19:35:50 +0900 (Tue, 27 Dec 2016)

  New Revision: 57214

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=57214

  Log:
    merge revision(s) 56938: [Backport #12988]
    
    Stop reading past the end of `ivptr` array
    
    If you have code like this:
    
    ```ruby
    class A
      def initialize
        @a = nil
        @b = nil
        @c = nil
        @d = nil
        @e = nil
      end
    end
    
    x = A.new
    y = x.clone
    100.times { |z| x.instance_variable_set(:"@foo#{z}", nil) }
    puts y.inspect
    ```
    
    `x` and `y` will share `iv_index_tbl` hashes.  However, the size of the
    hash will grow larger than the number if entries in `ivptr` in `y`.
    Before this commit, `rb_ivar_count` would use the size of the hash to
    determine how far to read in to the array, but this means that it could
    read past the end of the array and cause the program to segv
    
    [ruby-core:78403]

  Modified directories:
    branches/ruby_2_2/
  Modified files:
    branches/ruby_2_2/ChangeLog
    branches/ruby_2_2/variable.c
    branches/ruby_2_2/version.h
Index: ruby_2_2/ChangeLog
===================================================================
--- ruby_2_2/ChangeLog	(revision 57213)
+++ ruby_2_2/ChangeLog	(revision 57214)
@@ -1,3 +1,8 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ChangeLog#L1
+Tue Dec 27 19:34:47 2016  Aaron Patterson <tenderlove@r...>
+
+	* variable.c (rb_ivar_count): stop reading past the end of ivptr array.
+	  [Bug #12988]
+
 Tue Dec 27 19:32:03 2016  Nobuyoshi Nakada  <nobu@r...>
 
 	* thread.c (rb_thread_s_abort_exc, rb_thread_s_abort_exc_set):
Index: ruby_2_2/variable.c
===================================================================
--- ruby_2_2/variable.c	(revision 57213)
+++ ruby_2_2/variable.c	(revision 57214)
@@ -1322,7 +1322,7 @@ rb_ivar_count(VALUE obj) https://github.com/ruby/ruby/blob/trunk/ruby_2_2/variable.c#L1322
     switch (BUILTIN_TYPE(obj)) {
       case T_OBJECT:
 	if ((tbl = ROBJECT_IV_INDEX_TBL(obj)) != 0) {
-	    st_index_t i, count, num = tbl->num_entries;
+	    st_index_t i, count, num = ROBJECT_NUMIV(obj);
 	    const VALUE *const ivptr = ROBJECT_IVPTR(obj);
 	    for (i = count = 0; i < num; ++i) {
 		if (ivptr[i] != Qundef) {
Index: ruby_2_2/version.h
===================================================================
--- ruby_2_2/version.h	(revision 57213)
+++ ruby_2_2/version.h	(revision 57214)
@@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/version.h#L1
 #define RUBY_VERSION "2.2.7"
 #define RUBY_RELEASE_DATE "2016-12-27"
-#define RUBY_PATCHLEVEL 404
+#define RUBY_PATCHLEVEL 405
 
 #define RUBY_RELEASE_YEAR 2016
 #define RUBY_RELEASE_MONTH 12

Property changes on: ruby_2_2
___________________________________________________________________
Modified: svn:mergeinfo
   Merged /trunk:r56938


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/