* marshal.c (r_object0): Fix Marshal crash for corrupt extended object.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54105 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 16 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 7ae23397a7..468b7ac4d6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Tue Mar 15 03:35:04 2016  Eric Hodel  <drbrain@segment7.net>
+
+	* marshal.c (r_object0): Fix Marshal crash for corrupt extended object.
+
 Tue Mar 15 01:22:27 2016  Charles Oliver Nutter  <headius@headius.com>
 
 	* test/ruby/test_rubyoptions.rb: make version matching support
diff --git a/marshal.c b/marshal.c
index d64e5ffc54..6639e03f45 100644
--- a/marshal.c
+++ b/marshal.c
@@ -1585,6 +1585,7 @@ r_object0(struct load_arg *arg, int *ivp, VALUE extmod)
 	{
 	    VALUE path = r_unique(arg);
 	    VALUE m = rb_path_to_class(path);
+	    if (NIL_P(extmod)) extmod = rb_ary_tmp_new(0);
 
 	    if (RB_TYPE_P(m, T_CLASS)) { /* prepended */
 		VALUE c;
@@ -1604,7 +1605,6 @@ r_object0(struct load_arg *arg, int *ivp, VALUE extmod)
 	    }
 	    else {
 		must_be_module(m, path);
-		if (NIL_P(extmod)) extmod = rb_ary_tmp_new(0);
 		rb_ary_push(extmod, m);
 
 		v = r_object0(arg, 0, extmod);
diff --git a/test/ruby/test_marshal.rb b/test/ruby/test_marshal.rb
index 8377de2155..49a8511e8e 100644
--- a/test/ruby/test_marshal.rb
+++ b/test/ruby/test_marshal.rb
@@ -718,4 +718,15 @@ class TestMarshal < Test::Unit::TestCase
     obj = [str, str]
     assert_equal(['X', 'X'], Marshal.load(Marshal.dump(obj), ->(v) { v == str ? v.upcase : v }))
   end
+
+  def test_marshal_load_extended_class_crash
+    crash = "\x04\be:\x0F\x00omparableo:\vObject\x00"
+
+    opt = %w[--disable=gems]
+    args = [opt, "Marshal.load(#{crash.dump})", true, true]
+    out, err, status = EnvUtil.invoke_ruby(*args)
+
+    assert_empty err
+    assert_predicate(status, :success?)
+  end
 end