Skip to content

Commit 22f1926

Browse files
author
matz
committed
* range.c (rb_range_beg_len): should return Qfalse for non-range
 object. * pack.c (EXTEND16): [ruby-dev:27383] * eval.c (set_trace_func): add rb_secure(4) to prevent adding tracing function. * lib/delegate.rb: document update from James Edward Gray II <james@grayproductions.net>. [ruby-core:05942] * process.c (proc_daemon): should restrict execution on levels higher than $SAFE=2. suggested by URABE Shyouhei <shyouhei@ice.uec.ac.jp>. * lib/forwardable.rb: replaced by new implementation from <Daniel.Berger@qwest.com>. [ruby-core:05899] * file.c (path_check_0): disallow sticky world writable directory in PATH (and $LOAD_PATH). [ruby-dev:27226] * numeric.c (fix_idiv): 1.div(1.0) should return integer value. [ruby-dev:27235] * lib/yaml.rb: require 'yaml/constants'. [ruby-core:5776] * lib/xmlrpc/client.rb (XMLRPC::Client::do_rpc): add charset information to content-type header.[ruby-core:5127] * lib/xmlrpc/server.rb (CGIServer::serve): ditto. * lib/xmlrpc/server.rb (ModRubyServer::serve): ditto. * lib/xmlrpc/server.rb (WEBrickServlet::service): ditto. * test/dbm/test_dbm.rb (TestDBM::test_s_open_error): remove test_s_open_error test to detect duplicate open. [ruby-dev:27202] * eval.c (splat_value): use to_a to splat non Array object. * object.c (nil_to_a): remove nil.to_a. [experimental] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@9349 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
1 parent 313e0cb commit 22f1926

21 files changed

+492
-215
lines changed

‎ChangeLog

Lines changed: 70 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,22 @@
1-
Wed Oct 05 04:42:38 2005 GOTOU Yuuzou <gotoyuzo@notwork.org>
1+
Thu Oct 6 01:02:19 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
2+
3+
* range.c (rb_range_beg_len): should return Qfalse for non-range
4+
object.
5+
6+
Wed Oct 5 04:42:38 2005 GOTOU Yuuzou <gotoyuzo@notwork.org>
27

38
* lib/xmlrpc/server.rb (XMLRPC::Server#initialize): should mount the
49
servlet on "/".
510

6-
Wed Oct 05 04:06:49 2005 GOTOU Yuuzou <gotoyuzo@notwork.org>
11+
Wed Oct 5 04:06:49 2005 GOTOU Yuuzou <gotoyuzo@notwork.org>
712

813
* lib/xmlrpc/server.rb (XMLRPC::Server#serve): delete wrong call
914
of "join".
1015

16+
Mon Oct 3 00:04:00 2005 Kazuhiro NISHIYAMA <zn@mbf.nifty.com>
17+
18+
* pack.c (EXTEND16): [ruby-dev:27383]
19+
1120
Sat Oct 1 23:55:24 2005 NAKAMURA Usaku <usa@ruby-lang.org>
1221

1322
* win32/win32.c (do_select, rb_w32_select): brush up.
@@ -73,6 +82,11 @@ Wed Sep 28 03:16:41 2005 NAKAMURA Usaku <usa@ruby-lang.org>
7382
* rubysig.h: fixed build problem with --enable-pthread on platforms
7483
which don't have setitimer().
7584

85+
Mon Sep 26 22:32:13 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
86+
87+
* eval.c (set_trace_func): add rb_secure(4) to prevent adding
88+
tracing function.
89+
7690
Mon Sep 26 20:59:28 2005 Hirokazu Yamamoto <ocean@m2.ccsnet.ne.jp>
7791

7892
* parse.y: changed to ANSI function style.
@@ -132,6 +146,7 @@ Sat Sep 24 11:44:28 2005 Minero Aoki <aamine@loveruby.net>
132146

133147
* test/net/http/test_http.rb: new file.
134148

149+
>>>>>>> 1.4662
135150
Sat Sep 24 08:54:05 2005 Minero Aoki <aamine@loveruby.net>
136151

137152
* lib/fileutils.rb (cd): no longer accept :noop option, related
@@ -193,6 +208,17 @@ Sat Sep 24 06:35:15 2005 Minero Aoki <aamine@loveruby.net>
193208

194209
* ext/ripper/lib/ripper/sexp.rb: ditto.
195210

211+
Sat Sep 24 02:40:20 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
212+
213+
* lib/delegate.rb: document update from James Edward Gray II
214+
<james@grayproductions.net>. [ruby-core:05942]
215+
216+
Sat Sep 24 02:05:51 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
217+
218+
* process.c (proc_daemon): should restrict execution on levels
219+
higher than $SAFE=2. suggested by URABE Shyouhei
220+
<shyouhei@ice.uec.ac.jp>.
221+
196222
Fri Sep 23 20:10:35 2005 Nobuyoshi Nakada <nobu@ruby-lang.org>
197223

198224
* ext/ripper/tools/generate.rb, ext/ripper/tools/preproc.rb: StringIO
@@ -203,6 +229,11 @@ Fri Sep 23 17:36:48 2005 Masaki Suketa <masaki.suketa@nifty.ne.jp>
203229
* ext/win32ole/win32ole.c: avoid core dump with WIN32OLE_EVENT.
204230
[ruby-dev:27133]
205231

232+
Fri Sep 23 16:27:39 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
233+
234+
* lib/forwardable.rb: replaced by new implementation from
235+
<Daniel.Berger@qwest.com>. [ruby-core:05899]
236+
206237
Fri Sep 23 07:07:47 2005 Minero Aoki <aamine@loveruby.net>
207238

208239
* test/ripper/depend: use --output option instead of redirect;
@@ -304,6 +335,16 @@ Wed Sep 21 07:43:58 2005 Nobuyoshi Nakada <nobu@ruby-lang.org>
304335
* lib/optparse.rb (default_argv, Arguable#options): defaults strings
305336
to be parsed to Arguable instance.
306337

338+
Wed Sep 21 02:44:09 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
339+
340+
* file.c (path_check_0): disallow sticky world writable directory
341+
in PATH (and $LOAD_PATH). [ruby-dev:27226]
342+
343+
Wed Sep 21 00:32:22 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
344+
345+
* numeric.c (fix_idiv): 1.div(1.0) should return integer value.
346+
[ruby-dev:27235]
347+
307348
Tue Sep 20 22:25:43 2005 Nobuyoshi Nakada <nobu@ruby-lang.org>
308349

309350
* ext/io/wait/lib/nonblock.rb: disable on platforms non-blocking flag
@@ -315,6 +356,21 @@ Tue Sep 20 18:23:04 2005 Tanaka Akira <akr@m17n.org>
315356

316357
* eval.c (thread_mark): mark th->last_status. [ruby-dev:27179]
317358

359+
Tue Sep 20 18:20:33 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
360+
361+
* lib/yaml.rb: require 'yaml/constants'. [ruby-core:5776]
362+
363+
Tue Sep 20 17:48:34 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
364+
365+
* lib/xmlrpc/client.rb (XMLRPC::Client::do_rpc): add charset
366+
information to content-type header.[ruby-core:5127]
367+
368+
* lib/xmlrpc/server.rb (CGIServer::serve): ditto.
369+
370+
* lib/xmlrpc/server.rb (ModRubyServer::serve): ditto.
371+
372+
* lib/xmlrpc/server.rb (WEBrickServlet::service): ditto.
373+
318374
Tue Sep 20 17:26:42 2005 Hirokazu Yamamoto <ocean@m2.ccsnet.ne.jp>
319375

320376
* test/webrick/test_cgi.rb: set ENV["PATH"] to CGIEnvPath on
@@ -326,6 +382,12 @@ Tue Sep 20 17:14:10 2005 Hirokazu Yamamoto <ocean@m2.ccsnet.ne.jp>
326382
* io.c: PIPE_BUF is not defined in BeOS. use _POSIX_PIPE_BUF instead.
327383
[ruby-dev:27185]
328384

385+
Tue Sep 20 17:10:38 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
386+
387+
* test/dbm/test_dbm.rb (TestDBM::test_s_open_error): remove
388+
test_s_open_error test to detect duplicate open.
389+
[ruby-dev:27202]
390+
329391
Tue Sep 20 15:39:40 2005 why the lucky stiff <why@ruby-lang.org>
330392

331393
* ext/syck/emitter.c (syck_scan_scalar): prevent indicators from
@@ -348,6 +410,12 @@ Tue Sep 20 05:48:26 2005 Hirokazu Yamamoto <ocean@m2.ccsnet.ne.jp>
348410
should not include 'webrick/https' unless 'use_ssl' because
349411
it fails where openssl is not installed.
350412

413+
Tue Sep 20 01:24:45 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
414+
415+
* eval.c (splat_value): use to_a to splat non Array object.
416+
417+
* object.c (nil_to_a): remove nil.to_a. [experimental]
418+
351419
Tue Sep 20 01:01:41 2005 Yukihiro Matsumoto <matz@ruby-lang.org>
352420

353421
* lib/mathn.rb (Fixnum): remove debug print.

‎defines.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,13 +42,17 @@
4242
#endif
4343

4444
#define xmalloc ruby_xmalloc
45+
#define xmalloc2 ruby_xmalloc2
4546
#define xcalloc ruby_xcalloc
4647
#define xrealloc ruby_xrealloc
48+
#define xrealloc2 ruby_xrealloc2
4749
#define xfree ruby_xfree
4850

4951
void *xmalloc(long);
52+
void *xmalloc2(long,long);
5053
void *xcalloc(long,long);
5154
void *xrealloc(void*,long);
55+
void *xrealloc2(void*,long,long);
5256
void xfree(void*);
5357

5458
#if SIZEOF_LONG_LONG > 0

‎eval.c

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2464,6 +2464,7 @@ set_trace_func(VALUE obj, VALUE trace)
24642464
{
24652465
rb_event_hook_t *hook;
24662466

2467+
rb_secure(4);
24672468
if (NIL_P(trace)) {
24682469
trace_func = 0;
24692470
rb_remove_event_hook(call_trace_func);
@@ -2644,11 +2645,7 @@ avalue_splat(VALUE v)
26442645
static VALUE
26452646
splat_value(VALUE v)
26462647
{
2647-
VALUE tmp = rb_check_array_type(v);
2648-
2649-
if (NIL_P(tmp)) v = rb_ary_new3(1, v);
2650-
else v = tmp;
2651-
return rb_values_from_ary(v);
2648+
return rb_values_from_ary(rb_convert_type(v, T_ARRAY, "Array", "to_a"));
26522649
}
26532650

26542651
static VALUE

‎file.c

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3840,7 +3840,7 @@ is_absolute_path(const char *path)
38403840

38413841
#ifndef DOSISH
38423842
static int
3843-
path_check_1(VALUE path)
3843+
path_check_0(VALUE path, int loadpath)
38443844
{
38453845
struct stat st;
38463846
char *p0 = StringValueCStr(path);
@@ -3855,15 +3855,15 @@ path_check_1(VALUE path)
38553855

38563856
rb_str_cat2(newpath, "/");
38573857
rb_str_cat2(newpath, p0);
3858-
return path_check_1(newpath);
3858+
return path_check_0(newpath, loadpath);
38593859
}
38603860
for (;;) {
38613861
#ifndef S_IWOTH
38623862
# define S_IWOTH 002
38633863
#endif
38643864
if (stat(p0, &st) == 0 && S_ISDIR(st.st_mode) && (st.st_mode & S_IWOTH)
38653865
#ifdef S_ISVTX
3866-
&& !(st.st_mode & S_ISVTX)
3866+
&& (loadpath || !(st.st_mode & S_ISVTX))
38673867
#endif
38683868
&& !access(p0, W_OK)) {
38693869
rb_warn("Insecure world writable dir %s, mode 0%o", p0, st.st_mode);
@@ -3879,6 +3879,17 @@ path_check_1(VALUE path)
38793879
}
38803880
#endif
38813881

3882+
static int
3883+
fpath_check(path)
3884+
char *path;
3885+
{
3886+
#ifndef DOSISH
3887+
return path_check_0(rb_str_new2(path), Qfalse);
3888+
#else
3889+
return 1;
3890+
#endif
3891+
}
3892+
38823893
int
38833894
rb_path_check(const char *path)
38843895
{
@@ -3894,7 +3905,7 @@ rb_path_check(const char *path)
38943905
if (!p) p = pend;
38953906

38963907
for (;;) {
3897-
if (!path_check_1(rb_str_new(p0, p - p0))) {
3908+
if (!path_check_0(rb_str_new(p0, p - p0), Qtrue)) {
38983909
return 0; /* not safe */
38993910
}
39003911
p0 = p + 1;
@@ -4001,15 +4012,15 @@ rb_find_file(VALUE path)
40014012

40024013
#if defined(__MACOS__) || defined(riscos)
40034014
if (is_macos_native_path(f)) {
4004-
if (rb_safe_level() >= 1 && !rb_path_check(f)) {
4015+
if (rb_safe_level() >= 1 && !fpath_check(f)) {
40054016
rb_raise(rb_eSecurityError, "loading from unsafe file %s", f);
40064017
}
40074018
if (file_load_ok(f)) return path;
40084019
}
40094020
#endif
40104021

40114022
if (is_absolute_path(f)) {
4012-
if (rb_safe_level() >= 1 && !rb_path_check(f)) {
4023+
if (rb_safe_level() >= 1 && !fpath_check(f)) {
40134024
rb_raise(rb_eSecurityError, "loading from unsafe file %s", f);
40144025
}
40154026
if (file_load_ok(f)) return path;
@@ -4050,7 +4061,7 @@ rb_find_file(VALUE path)
40504061
return 0; /* no path, no load */
40514062
}
40524063
f = dln_find_file(f, lpath);
4053-
if (rb_safe_level() >= 1 && !rb_path_check(f)) {
4064+
if (rb_safe_level() >= 1 && !fpath_check(f)) {
40544065
rb_raise(rb_eSecurityError, "loading from unsafe file %s", f);
40554066
}
40564067
if (file_load_ok(f)) {

‎gc.c

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,12 +133,22 @@ ruby_xmalloc(long size)
133133
return mem;
134134
}
135135

136+
void *
137+
ruby_xmalloc2(long n, long size)
138+
{
139+
long len = size * n;
140+
if (len < n || (n > 0 && len < size)) {
141+
rb_raise(rb_eArgError, "malloc: possible integer overflow");
142+
}
143+
return ruby_xmalloc(len);
144+
}
145+
136146
void *
137147
ruby_xcalloc(long n, long size)
138148
{
139149
void *mem;
140150

141-
mem = xmalloc(n * size);
151+
mem = ruby_xmalloc2(n, size);
142152
memset(mem, 0, n * size);
143153

144154
return mem;
@@ -152,7 +162,7 @@ ruby_xrealloc(void *ptr, long size)
152162
if (size < 0) {
153163
rb_raise(rb_eArgError, "negative re-allocation size");
154164
}
155-
if (!ptr) return xmalloc(size);
165+
if (!ptr) return ruby_xmalloc(size);
156166
if (size == 0) size = 1;
157167
malloc_increase += size;
158168
RUBY_CRITICAL(mem = realloc(ptr, size));
@@ -168,6 +178,16 @@ ruby_xrealloc(void *ptr, long size)
168178
return mem;
169179
}
170180

181+
void *
182+
ruby_xrealloc2(void *ptr, long n, long size)
183+
{
184+
long len = size * n;
185+
if (len < n || (n > 0 && len < size)) {
186+
rb_raise(rb_eArgError, "realloc: possible integer overflow");
187+
}
188+
return ruby_xrealloc(ptr, len);
189+
}
190+
171191
void
172192
ruby_xfree(void *x)
173193
{

‎lib/.document

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,11 @@ cgi
1414
cgi.rb
1515
complex.rb
1616
date.rb
17+
delegate.rb
18+
erb.rb
1719
fileutils.rb
1820
find.rb
21+
forwardable.rb
1922
generator.rb
2023
logger.rb
2124
matrix.rb

0 commit comments

Comments
 (0)