nobu	2018-03-01 08:31:42 +0900 (Thu, 01 Mar 2018)

  New Revision: 62615

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=62615

  Log:
    Revert r61936 "compile.c: use ALLOCV_N"
    
    * compile.c (ibf_dump_object_list): `dump->obj_list` is not fixed
      yet, as new objects are pushed by lbf_dump_object_object.
      fixes crash by buffer overflow.

  Modified files:
    trunk/compile.c
    trunk/test/ruby/test_iseq.rb
Index: compile.c
===================================================================
--- compile.c	(revision 62614)
+++ compile.c	(revision 62615)
@@ -9334,23 +9334,21 @@ ibf_load_object(const struct ibf_load *l https://github.com/ruby/ruby/blob/trunk/compile.c#L9334
 static void
 ibf_dump_object_list(struct ibf_dump *dump, struct ibf_header *header)
 {
-    VALUE listv;
-    ibf_offset_t *list = ALLOCV_N(ibf_offset_t, listv, RARRAY_LEN(dump->obj_list));
+    VALUE list = rb_ary_tmp_new(RARRAY_LEN(dump->obj_list));
     int i, size;
 
     for (i=0; i<RARRAY_LEN(dump->obj_list); i++) {
 	VALUE obj = RARRAY_AREF(dump->obj_list, i);
 	ibf_offset_t offset = lbf_dump_object_object(dump, obj);
-	list[i] = offset;
+	rb_ary_push(list, UINT2NUM(offset));
     }
     size = i;
     header->object_list_offset = ibf_dump_pos(dump);
 
     for (i=0; i<size; i++) {
-	ibf_offset_t offset = list[i];
+	ibf_offset_t offset = NUM2UINT(RARRAY_AREF(list, i));
 	IBF_WV(offset);
     }
-    ALLOCV_END(listv);
 
     header->object_list_size = size;
 }
Index: test/ruby/test_iseq.rb
===================================================================
--- test/ruby/test_iseq.rb	(revision 62614)
+++ test/ruby/test_iseq.rb	(revision 62615)
@@ -395,4 +395,13 @@ class TestISeq < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_iseq.rb#L395
       end
     }
   end
+
+  def test_to_binary_with_objects
+    code = "[]"+100.times.map{|i|"<</#{i}/"}.join
+    bin = assert_nothing_raised {
+      RubyVM::InstructionSequence.compile(code).to_binary
+    }
+    # load_from_binary doesn't work now
+    assert_instance_of(String, bin)
+  end
 end

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/