From d24e1dac2b66afc3265065209686970481fb5367 Mon Sep 17 00:00:00 2001
From: kosaki <kosaki@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Wed, 14 Sep 2011 02:44:57 +0000
Subject: * thread.c (rb_fd_rcopy): added an argument guard.   Patch by
 NAKAMURA Usaku. [Bug #5306] [ruby-core:39435]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33266 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog | 5 +++++
 thread.c  | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 9b94bd7894..034c05ea1d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Wed Sep 14 11:43:37 2011  KOSAKI Motohiro  <kosaki.motohiro@gmail.com>
+
+	* thread.c (rb_fd_rcopy): added an argument guard.
+	  Patch by NAKAMURA Usaku. [Bug #5306] [ruby-core:39435]
+
 Tue Sep 13 20:21:49 2011  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* lib/pstore.rb, test/test_pstore.rb: suppress warnings with -v.
diff --git a/thread.c b/thread.c
index 4f8a907764..10b73eb3e4 100644
--- a/thread.c
+++ b/thread.c
@@ -2469,7 +2469,9 @@ rb_fd_rcopy(fd_set *dst, rb_fdset_t *src)
 {
     int max = rb_fd_max(src);
 
-    if (max > FD_SETSIZE) {
+    /* we assume src is the result of select() with dst, so dst should be
+     * larger or equal than src. */
+    if (max > FD_SETSIZE || max > dst->fd_count) {
 	rb_raise(rb_eArgError, "too large fdsets");
     }
 
-- 
cgit v1.2.3