* range.c (rb_range_beg_len): should return Qfalse for non-range

  object.

* pack.c (EXTEND16): [ruby-dev:27383]

* eval.c (set_trace_func): add rb_secure(4) to prevent adding
  tracing function.

* lib/delegate.rb: document update from James Edward Gray II
  <james@grayproductions.net>.  [ruby-core:05942]

* process.c (proc_daemon): should restrict execution on levels
  higher than $SAFE=2.  suggested by URABE Shyouhei
  <shyouhei@ice.uec.ac.jp>.

* lib/forwardable.rb: replaced by new implementation from
  <Daniel.Berger@qwest.com>.  [ruby-core:05899]

* file.c (path_check_0): disallow sticky world writable directory
  in PATH (and $LOAD_PATH).  [ruby-dev:27226]

* numeric.c (fix_idiv): 1.div(1.0) should return integer value.
  [ruby-dev:27235]

* lib/yaml.rb: require 'yaml/constants'.  [ruby-core:5776]

* lib/xmlrpc/client.rb (XMLRPC::Client::do_rpc): add charset
  information to content-type header.[ruby-core:5127]

* lib/xmlrpc/server.rb (CGIServer::serve): ditto.

* lib/xmlrpc/server.rb (ModRubyServer::serve): ditto.

* lib/xmlrpc/server.rb (WEBrickServlet::service): ditto.

* test/dbm/test_dbm.rb (TestDBM::test_s_open_error): remove
  test_s_open_error test to detect duplicate open.
  [ruby-dev:27202]

* eval.c (splat_value): use to_a to splat non Array object.

* object.c (nil_to_a): remove nil.to_a.  [experimental]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@9349 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 22 insertions, 2 deletions

diff --git a/gc.c b/gc.c
index ed006e17d6..3bba989a10 100644
--- a/gc.c
+++ b/gc.c
@@ -134,11 +134,21 @@ ruby_xmalloc(long size)
 }
 
 void *
+ruby_xmalloc2(long n, long size)
+{
+    long len = size * n;
+    if (len < n || (n > 0 && len < size)) {
+	rb_raise(rb_eArgError, "malloc: possible integer overflow");
+    }
+    return ruby_xmalloc(len);
+}
+
+void *
 ruby_xcalloc(long n, long size)
 {
     void *mem;
 
-    mem = xmalloc(n * size);
+    mem = ruby_xmalloc2(n, size);
     memset(mem, 0, n * size);
 
     return mem;
@@ -152,7 +162,7 @@ ruby_xrealloc(void *ptr, long size)
     if (size < 0) {
 	rb_raise(rb_eArgError, "negative re-allocation size");
     }
-    if (!ptr) return xmalloc(size);
+    if (!ptr) return ruby_xmalloc(size);
     if (size == 0) size = 1;
     malloc_increase += size;
     RUBY_CRITICAL(mem = realloc(ptr, size));
@@ -168,6 +178,16 @@ ruby_xrealloc(void *ptr, long size)
     return mem;
 }
 
+void *
+ruby_xrealloc2(void *ptr, long n, long size)
+{
+    long len = size * n;
+    if (len < n || (n > 0 && len < size)) {
+	rb_raise(rb_eArgError, "realloc: possible integer overflow");
+    }
+    return ruby_xrealloc(ptr, len);
+}
+
 void
 ruby_xfree(void *x)
 {