merge revision(s) 54465: [Backport #12237]

	* thread.c (update_coverage): Do not track coverage in loaded files
	  after Coverage.result. Avoids out-of-bounds access. [Bug #12237]

	* ext/coverage/coverage.c (coverage_clear_result_i): document.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@54680 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

4 files changed, 10 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 44155bdc8b..054ffd0f15 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Fri Apr 22 15:08:27 2016  Benoit Daloze  <eregontp@gmail.com>
+
+	* thread.c (update_coverage): Do not track coverage in loaded files
+	  after Coverage.result. Avoids out-of-bounds access. [Bug #12237]
+
+	* ext/coverage/coverage.c (coverage_clear_result_i): document.
+
 Fri Apr 22 14:56:46 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* ext/date/date_core.c (Init_date_core): [DOC] fix misplaced doc
diff --git a/ext/coverage/coverage.c b/ext/coverage/coverage.c
index 93cb2a5c9e..e15357e734 100644
--- a/ext/coverage/coverage.c
+++ b/ext/coverage/coverage.c
@@ -32,6 +32,7 @@ rb_coverage_start(VALUE klass)
     return Qnil;
 }
 
+/* Make coverage arrays empty so old covered files are no longer tracked. */
 static int
 coverage_result_i(st_data_t key, st_data_t val, st_data_t h)
 {
diff --git a/thread.c b/thread.c
index b7056a764d..f9869d5d1e 100644
--- a/thread.c
+++ b/thread.c
@@ -5181,7 +5181,7 @@ update_coverage(rb_event_flag_t event, VALUE proc, VALUE self, ID id, VALUE klas
     if (coverage && RBASIC(coverage)->klass == 0) {
 	long line = rb_sourceline() - 1;
 	long count;
-	if (RARRAY_AREF(coverage, line) == Qnil) {
+	if (line >= RARRAY_LEN(coverage)) { /* no longer tracked */
 	    return;
 	}
 	count = FIX2LONG(RARRAY_AREF(coverage, line)) + 1;
diff --git a/version.h b/version.h
index de7e1f4861..f4b8806510 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.2.5"
 #define RUBY_RELEASE_DATE "2016-04-22"
-#define RUBY_PATCHLEVEL 299
+#define RUBY_PATCHLEVEL 300
 
 #define RUBY_RELEASE_YEAR 2016
 #define RUBY_RELEASE_MONTH 4