nobu	2017-03-21 12:15:56 +0900 (Tue, 21 Mar 2017)

  New Revision: 58040

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=58040

  Log:
    stringio.c: check character code
    
    * ext/stringio/stringio.c (strio_ungetc): check if the character
      code is valid in the encoding.  reported by Ahmad Sherif
      (ahmadsherif) at https://hackerone.com/reports/209593.

  Modified files:
    trunk/ext/stringio/stringio.c
    trunk/test/stringio/test_stringio.rb
Index: ext/stringio/stringio.c
===================================================================
--- ext/stringio/stringio.c	(revision 58039)
+++ ext/stringio/stringio.c	(revision 58040)
@@ -767,12 +767,14 @@ strio_ungetc(VALUE self, VALUE c) https://github.com/ruby/ruby/blob/trunk/ext/stringio/stringio.c#L767
     check_modifiable(ptr);
     if (NIL_P(c)) return Qnil;
     if (FIXNUM_P(c)) {
-	int cc = FIX2INT(c);
+	int len, cc = FIX2INT(c);
 	char buf[16];
 
 	enc = rb_enc_get(ptr->string);
+	len = rb_enc_codelen(cc, enc);
+	if (len <= 0) rb_enc_uint_chr(cc, enc);
 	rb_enc_mbcput(cc, buf, enc);
-	return strio_unget_bytes(ptr, buf, rb_enc_codelen(cc, enc));
+	return strio_unget_bytes(ptr, buf, len);
     }
     else {
 	SafeStringValue(c);
Index: test/stringio/test_stringio.rb
===================================================================
--- test/stringio/test_stringio.rb	(revision 58039)
+++ test/stringio/test_stringio.rb	(revision 58040)
@@ -453,6 +453,8 @@ class TestStringIO < Test::Unit::TestCas https://github.com/ruby/ruby/blob/trunk/test/stringio/test_stringio.rb#L453
     f.ungetc("y".ord)
     assert_equal("y", f.getc)
     assert_equal("2", f.getc)
+
+    assert_raise(RangeError) {f.ungetc(0x1ffffff)}
   ensure
     f.close unless f.closed?
   end

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/