* struct.c (rb_struct_modify): should check frozen and taint

  status.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@1667 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 18 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 334e768a86..2939dc5ee1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,11 @@ Mon Aug  6 03:29:03 2001  Yukihiro Matsumoto  <matz@ruby-lang.org>
 
 	* string.c (rb_str_rstrip_bang): new method.
 
+Mon Aug  6 00:35:03 2001  Guy Decoux  <decoux@moulon.inra.fr>
+
+	* struct.c (rb_struct_modify): should check frozen and taint
+	  status.
+
 Sun Aug  5 19:28:39 2001  Nobuyoshi Nakada <nobu.nakada@nifty.ne.jp>
 
 	* string.c (rb_str_associate): should consider STR_ASSOC too.
diff --git a/struct.c b/struct.c
index 69e94d282a..f8e6b6f3e0 100644
--- a/struct.c
+++ b/struct.c
@@ -124,6 +124,15 @@ static VALUE (*ref_func[10])() = {
     rb_struct_ref9,
 };
 
+static void
+rb_struct_modify(s)
+    VALUE s;
+{
+    if (OBJ_FROZEN(s)) rb_error_frozen("Struct");
+    if (!OBJ_TAINTED(s) && rb_safe_level() >= 4)
+       rb_raise(rb_eSecurityError, "Insecure: can't modify Struct");
+}
+
 static VALUE
 rb_struct_set(obj, val)
     VALUE obj, val;
@@ -135,6 +144,7 @@ rb_struct_set(obj, val)
     if (NIL_P(member)) {
 	rb_bug("non-initialized struct");
     }
+    rb_struct_modify(obj);
     for (i=0; i<RARRAY(member)->len; i++) {
 	slot = RARRAY(member)->ptr[i];
 	if (rb_id_attrset(SYM2ID(slot)) == rb_frame_last_func()) {
@@ -254,6 +264,7 @@ rb_struct_initialize(self, values)
     VALUE size;
     long n;
 
+    rb_struct_modify(self);
     size = iv_get(klass, "__size__");
     n = FIX2LONG(size);
     if (n < RARRAY(values)->len) {
@@ -474,7 +485,7 @@ rb_struct_aset_id(s, id, val)
 	rb_bug("non-initialized struct");
     }
 
-    if (OBJ_FROZEN(s)) rb_error_frozen("Struct");
+    rb_struct_modify(s);
     len = RARRAY(member)->len;
     for (i=0; i<len; i++) {
 	if (SYM2ID(RARRAY(member)->ptr[i]) == id) {
@@ -505,7 +516,7 @@ rb_struct_aset(s, idx, val)
         rb_raise(rb_eIndexError, "offset %d too large for struct(size:%d)",
 		 i, RSTRUCT(s)->len);
     }
-    if (OBJ_FROZEN(s)) rb_error_frozen("Struct");
+    rb_struct_modify(s);
     return RSTRUCT(s)->ptr[i] = val;
 }