merge revision(s) 33266:

	* thread.c (rb_fd_rcopy): added an argument guard.
	  Patch by NAKAMURA Usaku. [Bug #5306] [ruby-core:39435]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@33268 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 10 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 2cd419fe9e..e612a059fb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Wed Sep 14 11:46:30 2011  KOSAKI Motohiro  <kosaki.motohiro@gmail.com>
+
+	* thread.c (rb_fd_rcopy): added an argument guard.
+	  Patch by NAKAMURA Usaku. [Bug #5306] [ruby-core:39435]
+
 Tue Sep 13 09:28:58 2011  Koichi Sasada  <ko1@atdot.net>
 
 	* NEWS: wrote about rb_reserved_fd_p() and objspace.
diff --git a/thread.c b/thread.c
index a6d709aaed..d9fe5506bc 100644
--- a/thread.c
+++ b/thread.c
@@ -2465,7 +2465,9 @@ rb_fd_rcopy(fd_set *dst, rb_fdset_t *src)
 {
     int max = rb_fd_max(src);
 
-    if (max > FD_SETSIZE) {
+    /* we assume src is the result of select() with dst, so dst should be
+     * larger or equal than src. */
+    if (max > FD_SETSIZE || max > dst->fd_count) {
 	rb_raise(rb_eArgError, "too large fdsets");
     }
 
diff --git a/version.h b/version.h
index 05f5f727f1..188500b267 100644
--- a/version.h
+++ b/version.h
@@ -1,10 +1,10 @@
 #define RUBY_VERSION "1.9.3"
 #define RUBY_PATCHLEVEL -1
 
-#define RUBY_RELEASE_DATE "2011-09-13"
+#define RUBY_RELEASE_DATE "2011-09-14"
 #define RUBY_RELEASE_YEAR 2011
 #define RUBY_RELEASE_MONTH 9
-#define RUBY_RELEASE_DAY 13
+#define RUBY_RELEASE_DAY 14
 
 #include "ruby/version.h"