* marshal.c (r_object): better allocation type check for

  TYPE_UCLASS. usage of allocation framework is disabled for now.

* variable.c (rb_class_path): Module may have subclass.

* string.c (rb_str_update): should maintain original negative
  offset.

* string.c (rb_str_subpat_set): ditto

* string.c (rb_str_aset): ditto.

* re.c (rb_reg_nth_match): should check negative nth.

* re.c (rb_reg_nth_defined): ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@1764 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 12 insertions, 0 deletions

diff --git a/marshal.c b/marshal.c
index 75062f480c..a7b2efebc6 100644
--- a/marshal.c
+++ b/marshal.c
@@ -796,11 +796,20 @@ r_object(arg)
       case TYPE_UCLASS:
 	{
 	    VALUE c = rb_path2class(r_unique(arg));
+	    VALUE tmp;
+
 	    v = r_object(arg);
 	    if (rb_special_const_p(v) ||
+		TYPE(v) == T_OBJECT || TYPE(v) == T_CLASS || TYPE(v) == T_MODULE || 
 		!RTEST(rb_funcall(c, '<', 1, RBASIC(v)->klass))) {
 		rb_raise(rb_eArgError, "dump format error (user class)");
 	    }
+#if 0
+	    tmp = rb_obj_alloc(c);
+	    if (TYPE(v) != TYPE(tmp)) {
+		rb_raise(rb_eArgError, "dump format error (user class)");
+	    }
+#endif
 	    RBASIC(v)->klass = c;
 	    return v;
 	}
@@ -968,6 +977,9 @@ r_object(arg)
 
 	    klass = rb_path2class(r_unique(arg));
 	    v = rb_obj_alloc(klass);
+	    if (TYPE(v) != T_OBJECT) {
+		rb_raise(rb_eArgError, "dump format error");
+	    }
 	    r_regist(v, arg);
 	    r_ivar(v, arg);
 	    return v;