psych_emitter.c: check tags range

* ext/psych/psych_emitter.c (start_document): should not exceed
  tags array range.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53079 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 23 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index c5b7799bab..eb4a635db0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,7 @@
-Sun Dec 13 18:27:53 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+Sun Dec 13 18:28:52 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* ext/psych/psych_emitter.c (start_document): should not exceed
+	  tags array range.
 
 	* ext/psych/psych_emitter.c (start_document): ensure string before
 	  encoding conversion.
diff --git a/ext/psych/psych_emitter.c b/ext/psych/psych_emitter.c
index 078ae2b680..371c285183 100644
--- a/ext/psych/psych_emitter.c
+++ b/ext/psych/psych_emitter.c
@@ -167,16 +167,18 @@ static VALUE start_document(VALUE self, VALUE version, VALUE tags, VALUE imp)
 
     if(RTEST(tags)) {
 	long i = 0;
+	long len;
 #ifdef HAVE_RUBY_ENCODING_H
 	rb_encoding * encoding = rb_utf8_encoding();
 #endif
 
 	Check_Type(tags, T_ARRAY);
 
-	head  = xcalloc((size_t)RARRAY_LEN(tags), sizeof(yaml_tag_directive_t));
+	len = RARRAY_LEN(tags);
+	head  = xcalloc((size_t)len, sizeof(yaml_tag_directive_t));
 	tail  = head;
 
-	for(i = 0; i < RARRAY_LEN(tags); i++) {
+	for(i = 0; i < len && i < RARRAY_LEN(tags); i++) {
 	    VALUE tuple = RARRAY_AREF(tags, i);
 	    VALUE name;
 	    VALUE value;
diff --git a/test/psych/test_emitter.rb b/test/psych/test_emitter.rb
index fe198bd1b1..b19501932b 100644
--- a/test/psych/test_emitter.rb
+++ b/test/psych/test_emitter.rb
@@ -90,5 +90,20 @@ module Psych
         @emitter.start_sequence(nil, nil, true, :foo)
       end
     end
+
+    def test_resizing_tags
+      tags = []
+      version = [1,1]
+      obj = Object.new
+      obj.instance_variable_set(:@tags, tags)
+      def obj.to_str
+        (1..10).map{|x| @tags.push(["AAAA","BBBB"])}
+        return "x"
+      end
+
+      tags.push([obj, "tag:TALOS"])
+      @emitter.start_document(version, tags, 0)
+      assert(true)
+    end
   end
 end