shyouhei	2008-06-08 01:50:57 +0900 (Sun, 08 Jun 2008)

  New Revision: 16903

  Modified files:
    branches/ruby_1_8_6/ChangeLog
    branches/ruby_1_8_6/marshal.c
    branches/ruby_1_8_6/test/ruby/test_marshal.rb
    branches/ruby_1_8_6/version.h

  Log:
    merge revision(s) 13699:13704:
    * marshal.c (r_bytes0): refined length check.  [ruby-dev:32059]
    * marshal.c (r_bytes0): check if source has enough data.
      [ruby-dev:32054]


  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/ChangeLog?r1=16903&r2=16902&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/version.h?r1=16903&r2=16902&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/marshal.c?r1=16903&r2=16902&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/test/ruby/test_marshal.rb?r1=16903&r2=16902&diff_format=u

Index: ruby_1_8_6/ChangeLog
===================================================================
--- ruby_1_8_6/ChangeLog	(revision 16902)
+++ ruby_1_8_6/ChangeLog	(revision 16903)
@@ -1,3 +1,12 @@
+Sun Jun  8 01:50:07 2008  Nobuyoshi Nakada  <nobu@r...>
+
+	* marshal.c (r_bytes0): refined length check.  [ruby-dev:32059]
+
+Sun Jun  8 01:50:07 2008  Nobuyoshi Nakada  <nobu@r...>
+
+	* marshal.c (r_bytes0): check if source has enough data.
+	  [ruby-dev:32054]
+
 Sun Jun  8 01:41:19 2008  Tanaka Akira  <akr@f...>
 
 	* ext/socket/socket.c (s_accept_nonblock): make accepted fd
Index: ruby_1_8_6/version.h
===================================================================
--- ruby_1_8_6/version.h	(revision 16902)
+++ ruby_1_8_6/version.h	(revision 16903)
@@ -2,7 +2,7 @@
 #define RUBY_RELEASE_DATE "2008-06-08"
 #define RUBY_VERSION_CODE 186
 #define RUBY_RELEASE_CODE 20080608
-#define RUBY_PATCHLEVEL 134
+#define RUBY_PATCHLEVEL 135
 
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 8
Index: ruby_1_8_6/marshal.c
===================================================================
--- ruby_1_8_6/marshal.c	(revision 16902)
+++ ruby_1_8_6/marshal.c	(revision 16903)
@@ -468,7 +468,7 @@
 	return;
     }
 
-    if (ivtbl = rb_generic_ivar_table(obj)) {
+    if ((ivtbl = rb_generic_ivar_table(obj)) != 0) {
 	w_byte(TYPE_IVAR, arg);
     }
     if (obj == Qnil) {
@@ -873,7 +873,7 @@
 
     if (len == 0) return rb_str_new(0, 0);
     if (TYPE(arg->src) == T_STRING) {
-	if (RSTRING(arg->src)->len > arg->offset) {
+	if (RSTRING(arg->src)->len - arg->offset >= len) {
 	    str = rb_str_new(RSTRING(arg->src)->ptr+arg->offset, len);
 	    arg->offset += len;
 	}
Index: ruby_1_8_6/test/ruby/test_marshal.rb
===================================================================
--- ruby_1_8_6/test/ruby/test_marshal.rb	(revision 16902)
+++ ruby_1_8_6/test/ruby/test_marshal.rb	(revision 16903)
@@ -45,4 +45,24 @@
       assert_equal(a, b)
     }
   end
+
+  class C
+    def initialize(str)
+      @str = str
+    end
+    def _dump(limit)
+      @str
+    end
+    def self._load(s)
+      new(s)
+    end
+  end
+
+  def test_too_long_string
+    (data = Marshal.dump(C.new("a")))[-2, 1] = "\003\377\377\377"
+    e = assert_raise(ArgumentError, "[ruby-dev:32054]") {
+      Marshal.load(data)
+    }
+    assert_equal("marshal data too short", e.message)
+  end
 end

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/