nagachika	2017-01-17 03:50:47 +0900 (Tue, 17 Jan 2017)

  New Revision: 57341

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=57341

  Log:
    merge revision(s) 56938: [Backport #12988]
    
    Stop reading past the end of `ivptr` array
    
    If you have code like this:
    
    ```ruby
    class A
      def initialize
        @a = nil
        @b = nil
        @c = nil
        @d = nil
        @e = nil
      end
    end
    
    x = A.new
    y = x.clone
    100.times { |z| x.instance_variable_set(:"@foo#{z}", nil) }
    puts y.inspect
    ```
    
    `x` and `y` will share `iv_index_tbl` hashes.  However, the size of the
    hash will grow larger than the number if entries in `ivptr` in `y`.
    Before this commit, `rb_ivar_count` would use the size of the hash to
    determine how far to read in to the array, but this means that it could
    read past the end of the array and cause the program to segv
    
    [ruby-core:78403]

  Modified directories:
    branches/ruby_2_3/
  Modified files:
    branches/ruby_2_3/variable.c
    branches/ruby_2_3/version.h
Index: ruby_2_3/variable.c
===================================================================
--- ruby_2_3/variable.c	(revision 57340)
+++ ruby_2_3/variable.c	(revision 57341)
@@ -1605,7 +1605,7 @@ rb_ivar_count(VALUE obj) https://github.com/ruby/ruby/blob/trunk/ruby_2_3/variable.c#L1605
     switch (BUILTIN_TYPE(obj)) {
       case T_OBJECT:
 	if ((tbl = ROBJECT_IV_INDEX_TBL(obj)) != 0) {
-	    st_index_t i, count, num = tbl->num_entries;
+	    st_index_t i, count, num = ROBJECT_NUMIV(obj);
 	    const VALUE *const ivptr = ROBJECT_IVPTR(obj);
 	    for (i = count = 0; i < num; ++i) {
 		if (ivptr[i] != Qundef) {
Index: ruby_2_3/version.h
===================================================================
--- ruby_2_3/version.h	(revision 57340)
+++ ruby_2_3/version.h	(revision 57341)
@@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_3/version.h#L1
 #define RUBY_VERSION "2.3.3"
 #define RUBY_RELEASE_DATE "2017-01-17"
-#define RUBY_PATCHLEVEL 225
+#define RUBY_PATCHLEVEL 226
 
 #define RUBY_RELEASE_YEAR 2017
 #define RUBY_RELEASE_MONTH 1

Property changes on: ruby_2_3
___________________________________________________________________
Modified: svn:mergeinfo
   Merged /trunk:r56938


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/