https://git.ruby-lang.org/ruby.git/commit/?id=8899fa0b3d

From 8899fa0b3d41fd27dd1a2c6f75106cb78ff27236 Mon Sep 17 00:00:00 2001
From: nagachika <nagachika@r...>
Date: Sun, 29 Aug 2021 19:09:35 +0900
Subject: merge revision(s)
 d43279edacd09edf3a43e02d62f5be475e7c3bcb,5dc36ddcd00fc556c04c15ce9770c5a84d7d43dc,523bf31564f160f899f8cf9f73540d6a6f687f17:
 [Backport #18138]

	Fix length calculation for Array#slice!

	Commit 4f24255 introduced a bug which allows a length to be passed to
	rb_ary_new4 which is too large, resulting in invalid memory access.

	For example:

	    (1..1000).to_a.slice!(-2, 1000)
	---
	 array.c | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)

	Add out of range tests for Array#slice!

	---
	 test/ruby/test_array.rb | 13 +++++++++++++
	 1 file changed, 13 insertions(+)

	Add negative position tests [Bug #18138]

	---
	 test/ruby/test_array.rb | 4 ++++
	 1 file changed, 4 insertions(+)
---
 array.c                 |  2 +-
 test/ruby/test_array.rb | 17 +++++++++++++++++
 version.h               |  4 ++--
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/array.c b/array.c
index c0c8016..7ed3b14 100644
--- a/array.c
+++ b/array.c
@@ -4072,7 +4072,7 @@ ary_slice_bang_by_rb_ary_splice(VALUE ary, long pos, long len) https://github.com/ruby/ruby/blob/trunk/array.c#L4072
     else if (orig_len < pos) {
         return Qnil;
     }
-    else if (orig_len < pos + len) {
+    if (orig_len < pos + len) {
         len = orig_len - pos;
     }
     if (len == 0) {
diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index 789531f..26d40fc 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -1563,6 +1563,8 @@ class TestArray < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_array.rb#L1563
 
     assert_nil(a.slice(10, -3))
     assert_equal @cls[], a.slice(10..7)
+
+    assert_equal([100], a.slice(-1, 1_000_000_000))
   end
 
   def test_slice!
@@ -1611,6 +1613,21 @@ class TestArray < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_array.rb#L1613
     assert_raise(ArgumentError) { @cls[1].slice!(0, 0, 0) }
   end
 
+  def test_slice_out_of_range!
+    a = @cls[*(1..100).to_a]
+
+    assert_nil(a.clone.slice!(-101..-1))
+    assert_nil(a.clone.slice!(-101..))
+
+    # assert_raise_with_message(RangeError, "((-101..-1).%(2)) out of range") { a.clone.slice!((-101..-1)%2) }
+    # assert_raise_with_message(RangeError, "((-101..).%(2)) out of range") { a.clone.slice!((-101..)%2) }
+
+    assert_nil(a.clone.slice!(10, -3))
+    assert_equal @cls[], a.clone.slice!(10..7)
+
+    assert_equal([100], a.clone.slice!(-1, 1_000_000_000))
+  end
+
   def test_sort
     a = @cls[ 4, 1, 2, 3 ]
     assert_equal(@cls[1, 2, 3, 4], a.sort)
diff --git a/version.h b/version.h
index ca67d7f..8ba96bd 100644
--- a/version.h
+++ b/version.h
@@ -12,11 +12,11 @@ https://github.com/ruby/ruby/blob/trunk/version.h#L12
 # define RUBY_VERSION_MINOR RUBY_API_VERSION_MINOR
 #define RUBY_VERSION_TEENY 3
 #define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR
-#define RUBY_PATCHLEVEL 124
+#define RUBY_PATCHLEVEL 125
 
 #define RUBY_RELEASE_YEAR 2021
 #define RUBY_RELEASE_MONTH 8
-#define RUBY_RELEASE_DAY 19
+#define RUBY_RELEASE_DAY 29
 
 #include "ruby/version.h"
 
-- 
cgit v1.1


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/