merge r46831 partially. these changes are from:

https://github.com/k-takata/Onigmo/commit/7abd7b29481f98eb92be786e3d33611fc7d000a0
[Bug #8716]

* include/ruby/oniguruma.h (ONIG_MAX_CAPTURE_GROUP_NUM,
  ONIGERR_TOO_MANY_CAPTURE_GROUPS): add cheking the number of capture
  groups.

* regerror.c (onig_error_code_to_format): ditto.

* regparse.c (scan_env_add_mem_entry): ditto.

* regexec.c (onig_region_copy, match_at): fix: segmation fault occurs
  when many groups are used.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47400 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

6 files changed, 28 insertions, 10 deletions

diff --git a/ChangeLog b/ChangeLog
index bb4d9a11df..62d4bcc213 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,20 @@
+Fri Sep  5 13:36:12 2014  NAKAMURA Usaku  <usa@ruby-lang.org>
+
+	merge r46831 partially.  these changes are from:
+	https://github.com/k-takata/Onigmo/commit/7abd7b29481f98eb92be786e3d33611fc7d000a0
+	[Bug #8716]
+
+	* include/ruby/oniguruma.h (ONIG_MAX_CAPTURE_GROUP_NUM,
+	  ONIGERR_TOO_MANY_CAPTURE_GROUPS): add cheking the number of capture
+	  groups.
+
+	* regerror.c (onig_error_code_to_format): ditto.
+
+	* regparse.c (scan_env_add_mem_entry): ditto.
+
+	* regexec.c (onig_region_copy, match_at): fix: segmation fault occurs
+	  when many groups are used.
+
 Fri Sep  5 13:06:53 2014  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* string.c (rb_str_resize): update capa only when buffer get
diff --git a/include/ruby/oniguruma.h b/include/ruby/oniguruma.h
index 0b645bd935..cdc4382596 100644
--- a/include/ruby/oniguruma.h
+++ b/include/ruby/oniguruma.h
@@ -340,6 +340,7 @@ int onigenc_str_bytelen_null P_((OnigEncoding enc, const OnigUChar* p));
 /* config parameters */
 #define ONIG_NREGION                          10
 #define ONIG_MAX_BACKREF_NUM                1000
+#define ONIG_MAX_CAPTURE_GROUP_NUM         32767
 #define ONIG_MAX_REPEAT_NUM               100000
 #define ONIG_MAX_MULTI_BYTE_RANGES_NUM     10000
 /* constants */
@@ -584,6 +585,7 @@ ONIG_EXTERN const OnigSyntaxType*   OnigDefaultSyntax;
 #define ONIGERR_NEVER_ENDING_RECURSION                       -221
 #define ONIGERR_GROUP_NUMBER_OVER_FOR_CAPTURE_HISTORY        -222
 #define ONIGERR_INVALID_CHAR_PROPERTY_NAME                   -223
+#define ONIGERR_TOO_MANY_CAPTURE_GROUPS                      -224
 #define ONIGERR_INVALID_CODE_POINT_VALUE                     -400
 #define ONIGERR_INVALID_WIDE_CHAR_VALUE                      -400
 #define ONIGERR_TOO_BIG_WIDE_CHAR_VALUE                      -401
diff --git a/regerror.c b/regerror.c
index 9c94d23018..d32b50d12b 100644
--- a/regerror.c
+++ b/regerror.c
@@ -133,6 +133,8 @@ onig_error_code_to_format(OnigPosition code)
     p = "too short multibyte code string"; break;
   case ONIGERR_TOO_BIG_BACKREF_NUMBER:
     p = "too big backref number"; break;
+  case ONIGERR_TOO_MANY_CAPTURE_GROUPS:
+    p = "too many capture groups are specified"; break;
   case ONIGERR_INVALID_BACKREF:
 #ifdef USE_NAMED_GROUP
     p = "invalid backref number/name"; break;
diff --git a/regint.h b/regint.h
index c26b2decff..7d0a16d8f6 100644
--- a/regint.h
+++ b/regint.h
@@ -239,8 +239,8 @@
 # include <stddef.h>
 #endif
 
-#ifdef __BORLANDC__
-#include <malloc.h>
+#ifdef _WIN32
+#include <malloc.h>	/* for alloca() */
 #endif
 
 #ifdef ONIG_DEBUG
diff --git a/regparse.c b/regparse.c
index 774ee0a960..7e57cfaaee 100644
--- a/regparse.c
+++ b/regparse.c
@@ -978,6 +978,8 @@ scan_env_add_mem_entry(ScanEnv* env)
   Node** p;
 
   need = env->num_mem + 1;
+  if (need > ONIG_MAX_CAPTURE_GROUP_NUM)
+    return ONIGERR_TOO_MANY_CAPTURE_GROUPS;
   if (need >= SCANENV_MEMNODES_SIZE) {
     if (env->mem_alloc <= need) {
       if (IS_NULL(env->mem_nodes_dynamic)) {
@@ -4960,14 +4962,9 @@ parse_enclose(Node** np, OnigToken* tok, int term, UChar** src, UChar* end,
 	*np = node_new_enclose_memory(env->option, 0);
 	CHECK_NULL_RETURN_MEMERR(*np);
 	num = scan_env_add_mem_entry(env);
-	if (num < 0) {
-	  onig_node_free(*np);
-	  return num;
-	}
-	else if (num >= (int )BIT_STATUS_BITS_NUM) {
-	  onig_node_free(*np);
+	if (num < 0) return num;
+	if (num >= (int )BIT_STATUS_BITS_NUM)
 	  return ONIGERR_GROUP_NUMBER_OVER_FOR_CAPTURE_HISTORY;
-	}
 	NENCLOSE(*np)->regnum = num;
 	BIT_STATUS_ON_AT_SIMPLE(env->capture_history, num);
       }
diff --git a/version.h b/version.h
index c06ad61d4d..fff4ce6241 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.0.0"
 #define RUBY_RELEASE_DATE "2014-09-05"
-#define RUBY_PATCHLEVEL 549
+#define RUBY_PATCHLEVEL 550
 
 #define RUBY_RELEASE_YEAR 2014
 #define RUBY_RELEASE_MONTH 9