* string.c (rb_str_sum): check was done with false pointer.

  [ruby-dev:24383]

* string.c (rb_str_sum): string may be altered.  [ruby-dev:24381]

* eval.c (rb_f_eval): defer pointer retrieval to prevent unsafe
  sourcefile string modification.  [ruby-dev:24373]

* io.c (io_read): block string buffer modification during
  rb_io_fread() by freezing it temporarily. [ruby-dev:24366]

* io.c (rb_io_s_popen): mode argument may be altered.
  [ruby-dev:24375]

* file.c (rb_file_s_basename): ext argument may be altered.
  [ruby-dev:24377]

* enum.c (enum_sort_by): use NODE instead of 2 element arrays.
  [ruby-dev:24378]

* string.c (rb_str_chomp_bang): StringValue() may change the
  receiver.  [ruby-dev:24371]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@6979 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 5 insertions, 1 deletions

diff --git a/io.c b/io.c
index 09fbde48f9..83e35f23fb 100644
--- a/io.c
+++ b/io.c
@@ -1067,11 +1067,13 @@ io_read(argc, argv, io)
 	StringValue(str);
 	rb_str_modify(str);
 	rb_str_resize(str,len);
+	FL_SET(str, FL_FREEZE);
     }
     if (len == 0) return str;
 
     READ_CHECK(fptr->f);
     n = rb_io_fread(RSTRING(str)->ptr, len, fptr->f);
+    FL_UNSET(str, FL_FREEZE);
     if (n == 0) {
 	rb_str_resize(str,0);
 	if (!fptr->f) return Qnil;
@@ -2721,7 +2723,9 @@ rb_io_popen(str, argc, argv, klass)
 	mode = rb_io_modenum_mode(FIX2INT(pmode), mbuf);
     }
     else {
-	mode = StringValuePtr(pmode);
+	strncpy(mbuf, StringValuePtr(pmode), sizeof(mbuf) - 1);
+	mbuf[sizeof(mbuf) - 1] = 0;
+	mode = mbuf;
     }
     SafeStringValue(pname);
     port = pipe_open(str, mode);