merge revision(s) 61636: [Backport #14257]

	string.c: out-of-bounds access

	* string.c (rb_str_enumerate_lines): fix out-of-bounds access when
	  record separator is longer than the last element.  [Bug #14257]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62421 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 3 insertions, 2 deletions

diff --git a/string.c b/string.c
index 6492a2a7fc..81cbf95e60 100644
--- a/string.c
+++ b/string.c
@@ -8015,7 +8015,8 @@ rb_str_enumerate_lines(int argc, VALUE *argv, VALUE str, VALUE ary)
 	    if (rsnewline) {
 		pend = chomp_newline(subptr, pend, enc);
 	    }
-	    else if (memcmp(pend - rslen, rsptr, rslen) == 0) {
+	    else if (pend - subptr >= rslen &&
+		     memcmp(pend - rslen, rsptr, rslen) == 0) {
 		pend -= rslen;
 	    }
 	}
diff --git a/version.h b/version.h
index 009006e677..54fc976635 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.5.0"
 #define RUBY_RELEASE_DATE "2018-02-16"
-#define RUBY_PATCHLEVEL 14
+#define RUBY_PATCHLEVEL 15
 
 #define RUBY_RELEASE_YEAR 2018
 #define RUBY_RELEASE_MONTH 2