From c9165d06441fcb126d1d36a9b2fb123d404d2001 Mon Sep 17 00:00:00 2001
From: drbrain <drbrain@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Wed, 16 Mar 2016 22:18:12 +0000
Subject: * marshal.c (r_object0):  raise ArgumentError when linking to
 undefined   object.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54136 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog                 |  5 +++++
 marshal.c                 |  5 +++++
 test/ruby/test_marshal.rb | 12 ++++++++++++
 3 files changed, 22 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index ae8cdc9a76..67005a1706 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Thu Mar 17 07:17:36 2016  Eric Hodel  <drbrain@segment7.net>
+
+	* marshal.c (r_object0):  raise ArgumentError when linking to undefined
+	  object.
+
 Thu Mar 17 00:45:00 2016  Kenta Murata  <mrkn@mrkn.jp>
 
 	* test/ruby/test_bignum.rb: Make sure to use Bignum values in the tests.
diff --git a/marshal.c b/marshal.c
index 6639e03f45..054b2aad0c 100644
--- a/marshal.c
+++ b/marshal.c
@@ -1965,6 +1965,11 @@ r_object0(struct load_arg *arg, int *ivp, VALUE extmod)
 	rb_raise(rb_eArgError, "dump format error(0x%x)", type);
 	break;
     }
+
+    if (v == Qundef) {
+	rb_raise(rb_eArgError, "dump format error (bad link)");
+    }
+
     return v;
 }
 
diff --git a/test/ruby/test_marshal.rb b/test/ruby/test_marshal.rb
index 3d7ce7d9e4..412039d106 100644
--- a/test/ruby/test_marshal.rb
+++ b/test/ruby/test_marshal.rb
@@ -725,4 +725,16 @@ class TestMarshal < Test::Unit::TestCase
     opt = %w[--disable=gems]
     assert_ruby_status(opt, "Marshal.load(#{crash.dump})")
   end
+
+  def test_marshal_load_r_prepare_reference_crash
+    crash = "\x04\bI/\x05\x00\x06:\x06E{\x06@\x05T"
+
+    opt = %w[--disable=gems]
+    assert_ruby_status(opt, <<-RUBY)
+begin
+  Marshal.load(#{crash.dump})
+rescue ArgumentError
+end
+    RUBY
+  end
 end
-- 
cgit v1.2.3