* io.c (argf_inplace_mode_set): prohibits an assignment of a tainted

  value.

* file.c (ruby_find_basename, ruby_find_extname): split from
  rb_file_s_basename() and rb_file_s_extname().

* util.c (ruby_add_suffix): support arbitrary length of the suffix
  to get rid of the potential buffer overflow.
  reported by tarui.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@28525 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 3 insertions, 0 deletions

diff --git a/io.c b/io.c
index 05b2d45832..675f158196 100644
--- a/io.c
+++ b/io.c
@@ -9558,6 +9558,9 @@ opt_i_get(ID id, VALUE *var)
 static VALUE
 argf_inplace_mode_set(VALUE argf, VALUE val)
 {
+    if (rb_safe_level() >= 1 && OBJ_TAINTED(val))
+	rb_insecure_operation();
+
     if (!RTEST(val)) {
 	if (ARGF.inplace) free(ARGF.inplace);
 	ARGF.inplace = 0;