merge revision(s) 34803:

	* complex.c (nucomp_marshal_load): raise error on invalid data.
	  reported by John Firebaugh [ruby-core:42860] [Bug #6076]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@34806 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

5 files changed, 26 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index d417dd2dad..c01153310c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sat Feb 25 16:39:13 2012  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* complex.c (nucomp_marshal_load): raise error on invalid data.
+	  reported by John Firebaugh [ruby-core:42860] [Bug #6076]
+
 Fri Feb 24 23:49:05 2012  Marc-Andre Lafortune  <ruby-core@marc-andre.ca>
 
 	* lib/ostruct.rb (delete_field): Bug fix so previous value is
diff --git a/complex.c b/complex.c
index 1617054816..5b1a5102a1 100644
--- a/complex.c
+++ b/complex.c
@@ -1260,6 +1260,8 @@ nucomp_marshal_load(VALUE self, VALUE a)
 {
     get_dat1(self);
     Check_Type(a, T_ARRAY);
+    if (RARRAY_LEN(a) != 2)
+	rb_raise(rb_eArgError, "marshaled complex must have an array whose length is 2 but %ld", RARRAY_LEN(a));
     dat->real = RARRAY_PTR(a)[0];
     dat->imag = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);
diff --git a/rational.c b/rational.c
index 40b480df6e..8aced2aee8 100644
--- a/rational.c
+++ b/rational.c
@@ -1606,6 +1606,8 @@ nurat_marshal_load(VALUE self, VALUE a)
 {
     get_dat1(self);
     Check_Type(a, T_ARRAY);
+    if (RARRAY_LEN(a) != 2)
+	rb_raise(rb_eArgError, "marshaled rational must have an array whose length is 2 but %ld", RARRAY_LEN(a));
     dat->num = RARRAY_PTR(a)[0];
     dat->den = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);
diff --git a/test/ruby/test_marshal.rb b/test/ruby/test_marshal.rb
index 3eebbfafca..7ec6959a6e 100644
--- a/test/ruby/test_marshal.rb
+++ b/test/ruby/test_marshal.rb
@@ -469,4 +469,18 @@ class TestMarshal < Test::Unit::TestCase
     assert_equal(o1.class, o2.class)
     assert_equal(o1.foo, o2.foo)
   end
+
+  def test_marshal_complex
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\x05")}
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\x06i\x00")}
+    assert_equal(Complex(1, 2), Marshal.load("\x04\bU:\fComplex[\ai\x06i\a"))
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\bi\x00i\x00i\x00")}
+  end
+
+  def test_marshal_rational
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\x05")}
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\x06i\x00")}
+    assert_equal(Rational(1, 2), Marshal.load("\x04\bU:\rRational[\ai\x06i\a"))
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\bi\x00i\x00i\x00")}
+  end
 end
diff --git a/version.h b/version.h
index 5ae8780b2d..05a144522a 100644
--- a/version.h
+++ b/version.h
@@ -1,10 +1,10 @@
 #define RUBY_VERSION "1.9.3"
-#define RUBY_PATCHLEVEL 143
+#define RUBY_PATCHLEVEL 144
 
-#define RUBY_RELEASE_DATE "2012-02-24"
+#define RUBY_RELEASE_DATE "2012-02-25"
 #define RUBY_RELEASE_YEAR 2012
 #define RUBY_RELEASE_MONTH 2
-#define RUBY_RELEASE_DAY 24
+#define RUBY_RELEASE_DAY 25
 
 #include "ruby/version.h"