* array.c (sort_2): *a - *b may overflow.

* array.c (ary_new): len*sizeof(VALUE) may be a positive value.

* array.c (rb_ary_initialize): ditto.

* object.c (rb_class_allocate_instance): move singleton class
  check from rb_obj_alloc().

* re.c (rb_reg_initialize): should not modify frozen Regexp.

* ext/tcltklib/tcltklib.c (ip_init): allocation framework.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@2720 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

11 files changed, 104 insertions, 59 deletions

diff --git a/ChangeLog b/ChangeLog
index a8167d8dcd..179ba9320b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,16 @@ Mon Aug 19 12:38:33 2002  Nobuyoshi Nakada  <nobu.nokada@softhome.net>
 	* eval.c (win32_get_exception_list, win32_set_exception_list):
 	  added.
 
+Sat Aug 17 23:01:25 2002  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* array.c (sort_2): *a - *b may overflow.
+
+Sat Aug 17 00:25:08 2002  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* array.c (ary_new): len*sizeof(VALUE) may be a positive value.
+
+	* array.c (rb_ary_initialize): ditto.
+
 Fri Aug 16 15:58:16 2002  WATANABE Hirofumi  <eban@ruby-lang.org>
 
 	* io.c (NOFILE): define NOFILE as 64 if not defined.
@@ -17,6 +27,11 @@ Fri Aug 16 15:37:04 2002  Nobuyoshi Nakada  <nobu.nokada@softhome.net>
 
 	* bignum.c (rb_cstr_to_inum): new decimal and octal string.
 
+Fri Aug 16 13:17:11 2002  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* object.c (rb_class_allocate_instance): move singleton class
+	  check from rb_obj_alloc().
+
 Fri Aug 16 11:47:24 2002  Nobuyoshi Nakada  <nobu.nokada@softhome.net>
 
 	* io.c (rb_io_fread): renamed from io_fread and made extern.
@@ -61,6 +76,14 @@ Thu Aug 15 20:38:58 2002  Nobuyoshi Nakada  <nobu.nokada@softhome.net>
 
 	* parse.y (yycompile): clear current node.
 
+Thu Aug 15 00:48:46 2002  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* re.c (rb_reg_initialize): should not modify frozen Regexp.
+
+Tue Aug 13 18:33:18 2002  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* ext/tcltklib/tcltklib.c (ip_init): allocation framework.
+
 Tue Aug 13 15:32:14 2002  Yukihiro Matsumoto  <matz@ruby-lang.org>
 
 	* hash.c (rb_hash_replace): should copy ifnone.
diff --git a/array.c b/array.c
index 4d9de4bd60..69bafe643c 100644
--- a/array.c
+++ b/array.c
@@ -110,7 +110,7 @@ ary_new(klass, len)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative array size (or size too big)");
     }
-    if (len > 0 && len * sizeof(VALUE) <= 0) {
+    if (len > 0 && len * sizeof(VALUE) <= len) {
 	rb_raise(rb_eArgError, "array size too big");
     }
     if (len == 0) len++;
@@ -236,7 +236,7 @@ rb_ary_initialize(argc, argv, ary)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative array size");
     }
-    if (len > 0 && len * sizeof(VALUE) <= 0) {
+    if (len > 0 && len * (long)sizeof(VALUE) <= len) {
 	rb_raise(rb_eArgError, "array size too big");
     }
     if (len > RARRAY(ary)->aux.capa) {
@@ -304,7 +304,7 @@ rb_ary_store(ary, idx, val)
 	    new_capa = ARY_DEFAULT_SIZE;
 	}
 	new_capa += idx;
-	if (new_capa > new_capa * (long)sizeof(VALUE)) {
+	if (new_capa * (long)sizeof(VALUE) <= new_capa) {
 	    rb_raise(rb_eArgError, "index too big");
 	}
 	RARRAY(ary)->aux.capa = new_capa;
@@ -1085,19 +1085,22 @@ sort_1(a, b)
 }
 
 static int
-sort_2(a, b)
-    VALUE *a, *b;
+sort_2(ap, bp)
+    VALUE *ap, *bp;
 {
     VALUE retval;
+    VALUE a = *ap, b = *ap;
 
-    if (FIXNUM_P(*a) && FIXNUM_P(*b)) {
-	return *a - *b;
+    if (FIXNUM_P(a) && FIXNUM_P(b)) {
+	if (a > b) return INT2FIX(1);
+	if (a < b) return INT2FIX(-1);
+	return INT2FIX(0);
     }
-    if (TYPE(*a) == T_STRING && TYPE(*b) == T_STRING) {
-	return rb_str_cmp(*a, *b);
+    if (TYPE(a) == T_STRING && TYPE(b) == T_STRING) {
+	return rb_str_cmp(a, b);
     }
 
-    retval = rb_funcall(*a, id_cmp, 1, *b);
+    retval = rb_funcall(a, id_cmp, 1, b);
     return rb_cmpint(retval);
 }
 
diff --git a/bignum.c b/bignum.c
index 36092c8427..f6cfce8d70 100644
--- a/bignum.c
+++ b/bignum.c
@@ -609,7 +609,9 @@ rb_big2str(x, base)
 	return rb_fix2str(x, base);
     }
     i = RBIGNUM(x)->len;
-    if (i == 0) return rb_str_new2("0");
+    if (i == 0 || (i == 1 && BDIGITS(x)[0] == 0)) {
+	return rb_str_new2("0");
+    }
     if (base == 10) {
 	j = (SIZEOF_BDIGITS/sizeof(char)*CHAR_BIT*i*241L)/800+2;
 	hbase = 10000;
@@ -846,15 +848,7 @@ rb_big_cmp(x, y)
 	break;
 
       case T_FLOAT:
-        {
-	    double d = rb_big2dbl(x);
-
-	    if (d == RFLOAT(y)->value) return INT2FIX(0);
-	    if (d > RFLOAT(y)->value) return INT2FIX(1);
-	    if (d < RFLOAT(y)->value) return INT2FIX(-1);
-	    rb_raise(rb_eFloatDomainError, "comparing NaN");
-	}
-	break;
+	return rb_dbl_cmp(rb_big2dbl(x), RFLOAT(y)->value);
 
       default:
 	return rb_num_coerce_bin(x, y);
diff --git a/ext/tcltklib/tcltklib.c b/ext/tcltklib/tcltklib.c
index 9ff5972910..1b59006009 100644
--- a/ext/tcltklib/tcltklib.c
+++ b/ext/tcltklib/tcltklib.c
@@ -343,6 +343,19 @@ struct tcltkip {
     int return_value;		/* return value */
 };
 
+static struct tcltkip *
+get_ip(self)
+    VALUE self;
+{
+    struct tcltkip *ptr;
+
+    Data_Get_Struct(self, struct tcltkip, ptr);
+    if (ptr == 0) {
+	rb_raise(rb_eTypeError, "uninitialized TclTkIp");
+    }
+    return ptr;
+}
+
 /* Tcl command `ruby' */
 static VALUE
 ip_eval_rescue(failed, einfo)
@@ -358,10 +371,7 @@ static VALUE
 lib_restart(self)
     VALUE self;
 {
-    struct tcltkip *ptr;	/* tcltkip data struct */
-
-    /* get the data struct */
-    Data_Get_Struct(self, struct tcltkip, ptr);
+    struct tcltkip *ptr = get_ip(self);
 
     /* destroy the root wdiget */
     ptr->return_value = Tcl_Eval(ptr->ip, "destroy .");
@@ -452,20 +462,30 @@ ip_free(ptr)
     struct tcltkip *ptr;
 {
     DUMP1("Tcl_DeleteInterp");
-    Tcl_DeleteInterp(ptr->ip);
-    free(ptr);
+    if (ptr) {
+	Tcl_DeleteInterp(ptr->ip);
+	free(ptr);
+    }
 }
 
 /* create and initialize interpreter */
 static VALUE
-ip_new(self)
+ip_alloc(self)
+    VALUE self;
+{
+    return Data_Wrap_Struct(self, 0, ip_free, 0);
+}
+
+static VALUE
+ip_init(self)
     VALUE self;
 {
     struct tcltkip *ptr;	/* tcltkip data struct */
-    VALUE obj;			/* newly created object */
 
     /* create object */
-    obj = Data_Make_Struct(self, struct tcltkip, 0, ip_free, ptr);
+    Data_Get_Struct(self, struct tcltkip, ptr);
+    ptr = ALLOC(struct tcltkip);
+    DATA_PTR(self) = ptr;
     ptr->return_value = 0;
 
     /* from Tk_Main() */
@@ -497,7 +517,7 @@ ip_new(self)
 		      (Tcl_CmdDeleteProc *)NULL);
 #endif
 
-    return obj;
+    return self;
 }
 
 /* eval string in tcl by Tcl_Eval() */
@@ -508,10 +528,7 @@ ip_eval(self, str)
 {
     char *s;
     char *buf;			/* Tcl_Eval requires re-writable string region */
-    struct tcltkip *ptr;	/* tcltkip data struct */
-
-    /* get the data struct */
-    Data_Get_Struct(self, struct tcltkip, ptr);
+    struct tcltkip *ptr = get_ip(self);
 
     /* call Tcl_Eval() */
     s = StringValuePtr(str);
@@ -542,7 +559,7 @@ ip_toUTF8(self, str, encodename)
     struct tcltkip *ptr;
     char *buf;
 
-    Data_Get_Struct(self,struct tcltkip, ptr);
+    ptr = get_ip(self);
     interp = ptr->ip;
 
     StringValue(encodename);
@@ -575,7 +592,7 @@ ip_fromUTF8(self, str, encodename)
     struct tcltkip *ptr;
     char *buf;
 
-    Data_Get_Struct(self,struct tcltkip, ptr);
+    ptr = get_ip(self);
     interp = ptr->ip;
 
     StringValue(encodename);
@@ -615,7 +632,7 @@ ip_invoke_real(argc, argv, obj)
 #endif
 
     /* get the data struct */
-    Data_Get_Struct(obj, struct tcltkip, ptr);
+    ptr = get_ip(obj);
 
     /* get the command name string */
     v = argv[0];
@@ -794,7 +811,7 @@ ip_retval(self)
     struct tcltkip *ptr;	/* tcltkip data struct */
 
     /* get the data strcut */
-    Data_Get_Struct(self, struct tcltkip, ptr);
+    ptr = get_ip(self);
 
     return (INT2FIX(ptr->return_value));
 }
@@ -845,7 +862,8 @@ Init_tcltklib()
     rb_define_module_function(lib, "get_eventloop_weight", 
 			      get_eventloop_weight, 0);
 
-    rb_define_singleton_method(ip, "new", ip_new, 0);
+    rb_define_singleton_method(ip, "allocate", ip_alloc, 0);
+    rb_define_method(ip, "initialize", ip_init, 0);
     rb_define_method(ip, "_eval", ip_eval, 1);
     rb_define_method(ip, "_toUTF8",ip_toUTF8,2);
     rb_define_method(ip, "_fromUTF8",ip_fromUTF8,2);
diff --git a/hash.c b/hash.c
index dc7483b771..c332f554c7 100644
--- a/hash.c
+++ b/hash.c
@@ -611,6 +611,9 @@ rb_hash_replace(hash, hash2)
     if (FL_TEST(hash2, HASH_PROC_DEFAULT)) {
 	FL_SET(hash, HASH_PROC_DEFAULT);
     }
+    else {
+	FL_UNSET(hash, HASH_PROC_DEFAULT);
+    }
 
     return hash;
 }
diff --git a/intern.h b/intern.h
index 2f9e2cd073..59fcfa67fc 100644
--- a/intern.h
+++ b/intern.h
@@ -258,6 +258,7 @@ VALUE rb_num_coerce_bin _((VALUE, VALUE));
 VALUE rb_float_new _((double));
 VALUE rb_num2fix _((VALUE));
 VALUE rb_fix2str _((VALUE, int));
+VALUE rb_dbl_cmp _((double, double));
 /* object.c */
 int rb_eql _((VALUE, VALUE));
 VALUE rb_any_to_s _((VALUE));
diff --git a/lib/cgi/session.rb b/lib/cgi/session.rb
index 5709178d0f..64a7bd7016 100644
--- a/lib/cgi/session.rb
+++ b/lib/cgi/session.rb
@@ -55,6 +55,9 @@ class CGI
 	@output_cookies =  [
           Cookie::new("name" => session_key,
 		      "value" => id,
+		      "expires" => option['session_expires'],
+		      "domain" => option['session_domain'],
+		      "secure" => option['session_secure'],
 		      "path" => if option['session_path'] then
 				  option['session_path']
 		                elsif ENV["SCRIPT_NAME"] then
diff --git a/numeric.c b/numeric.c
index a62f53f748..87d7e986a4 100644
--- a/numeric.c
+++ b/numeric.c
@@ -479,6 +479,16 @@ flo_hash(num)
     return INT2FIX(hash);
 }
 
+VALUE
+rb_dbl_cmp(a, b)
+    double a, b;
+{
+    if (a == b) return INT2FIX(0);
+    if (a > b) return INT2FIX(1);
+    if (a < b) return INT2FIX(-1);
+    rb_raise(rb_eFloatDomainError, "comparing NaN");
+}
+
 static VALUE
 flo_cmp(x, y)
     VALUE x, y;
@@ -502,10 +512,7 @@ flo_cmp(x, y)
       default:
 	return rb_num_coerce_bin(x, y);
     }
-    if (a == b) return INT2FIX(0);
-    if (a > b) return INT2FIX(1);
-    if (a < b) return INT2FIX(-1);
-    rb_raise(rb_eFloatDomainError, "comparing NaN");
+    return rb_dbl_cmp(a, b);
 }
 
 static VALUE
diff --git a/object.c b/object.c
index 13ae657ee1..7523b7aa3e 100644
--- a/object.c
+++ b/object.c
@@ -667,12 +667,7 @@ VALUE
 rb_obj_alloc(klass)
     VALUE klass;
 {
-    VALUE obj;
-
-    if (FL_TEST(klass, FL_SINGLETON)) {
-	rb_raise(rb_eTypeError, "can't create instance of virtual class");
-    }
-    obj = rb_funcall(klass, alloc, 0, 0);
+    VALUE obj = rb_funcall(klass, alloc, 0, 0);
 
     if (rb_obj_class(obj) != rb_class_real(klass)) {
 	rb_raise(rb_eTypeError, "wrong instance allocation");
@@ -684,6 +679,9 @@ static VALUE
 rb_class_allocate_instance(klass)
     VALUE klass;
 {
+    if (FL_TEST(klass, FL_SINGLETON)) {
+	rb_raise(rb_eTypeError, "can't create instance of virtual class");
+    }
     if (rb_frame_last_func() != alloc) {
 	return rb_obj_alloc(klass);
     }
diff --git a/re.c b/re.c
index 5663f02919..94cefa4bbc 100644
--- a/re.c
+++ b/re.c
@@ -959,6 +959,9 @@ rb_reg_initialize(obj, s, len, options)
 {
     struct RRegexp *re = RREGEXP(obj);
 
+    if (OBJ_FROZEN(obj)) {
+	rb_error_frozen("Regexp");
+    }
     if (re->ptr) re_free_pattern(re->ptr);
     if (re->str) free(re->str);
     re->ptr = 0;
diff --git a/time.c b/time.c
index fe22303b83..57027ca928 100644
--- a/time.c
+++ b/time.c
@@ -713,16 +713,8 @@ time_cmp(time1, time2)
 	return INT2FIX(-1);
 	
       case T_FLOAT:
-	{
-	    double t;
-
-	    t = (double)tobj1->tv.tv_sec + (double)tobj1->tv.tv_usec*1e-6;
-	    if (t > RFLOAT(time2)->value)
-		return INT2FIX(1);
-	    if (t < RFLOAT(time2)->value)
-		return INT2FIX(-1);
-	    return INT2FIX(0);
-	}
+	return rb_dbl_cmp((double)tobj1->tv.tv_sec + (double)tobj1->tv.tv_usec*1e-6,
+			  RFLOAT(time2)->value);
     }
 
     if (rb_obj_is_kind_of(time2, rb_cTime)) {