parse.y: check NTH_REF range

* compile.c (iseq_compile_each): out of range NTH_REF is always
  nil.
* parse.y (parse_numvar): check overflow of NTH_REF and range.
  [ruby-core:69393] [Bug #11192]
* util.c (ruby_scan_digits): make public and add length parameter.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@50671 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 4 insertions, 0 deletions

diff --git a/compile.c b/compile.c
index e5cf964530..cdcb19b0ef 100644
--- a/compile.c
+++ b/compile.c
@@ -4920,6 +4920,10 @@ iseq_compile_each(rb_iseq_t *iseq, LINK_ANCHOR *ret, NODE * node, int poped)
       }
       case NODE_NTH_REF:{
         if (!poped) {
+	    if (!node->nd_nth) {
+		ADD_INSN(ret, line, putnil);
+		break;
+	    }
 	    ADD_INSN2(ret, line, getspecial, INT2FIX(1) /* '~'  */,
 		      INT2FIX(node->nd_nth << 1));
 	}