From 22d1dba88c81ba4be5f9108885578df0314f832f Mon Sep 17 00:00:00 2001 From: drbrain Date: Mon, 14 Mar 2016 18:36:14 +0000 Subject: * marshal.c (r_object0): Fix Marshal crash for corrupt extended object. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54105 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ChangeLog | 4 ++++ marshal.c | 2 +- test/ruby/test_marshal.rb | 11 +++++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 7ae23397a7..468b7ac4d6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +Tue Mar 15 03:35:04 2016 Eric Hodel + + * marshal.c (r_object0): Fix Marshal crash for corrupt extended object. + Tue Mar 15 01:22:27 2016 Charles Oliver Nutter * test/ruby/test_rubyoptions.rb: make version matching support diff --git a/marshal.c b/marshal.c index d64e5ffc54..6639e03f45 100644 --- a/marshal.c +++ b/marshal.c @@ -1585,6 +1585,7 @@ r_object0(struct load_arg *arg, int *ivp, VALUE extmod) { VALUE path = r_unique(arg); VALUE m = rb_path_to_class(path); + if (NIL_P(extmod)) extmod = rb_ary_tmp_new(0); if (RB_TYPE_P(m, T_CLASS)) { /* prepended */ VALUE c; @@ -1604,7 +1605,6 @@ r_object0(struct load_arg *arg, int *ivp, VALUE extmod) } else { must_be_module(m, path); - if (NIL_P(extmod)) extmod = rb_ary_tmp_new(0); rb_ary_push(extmod, m); v = r_object0(arg, 0, extmod); diff --git a/test/ruby/test_marshal.rb b/test/ruby/test_marshal.rb index 8377de2155..49a8511e8e 100644 --- a/test/ruby/test_marshal.rb +++ b/test/ruby/test_marshal.rb @@ -718,4 +718,15 @@ class TestMarshal < Test::Unit::TestCase obj = [str, str] assert_equal(['X', 'X'], Marshal.load(Marshal.dump(obj), ->(v) { v == str ? v.upcase : v })) end + + def test_marshal_load_extended_class_crash + crash = "\x04\be:\x0F\x00omparableo:\vObject\x00" + + opt = %w[--disable=gems] + args = [opt, "Marshal.load(#{crash.dump})", true, true] + out, err, status = EnvUtil.invoke_ruby(*args) + + assert_empty err + assert_predicate(status, :success?) + end end -- cgit v1.2.3