* sprintf.c (rb_str_format): allow %c to print one character

  string (e.g. ?x).

* lib/tempfile.rb (Tempfile::make_tmpname): put dot between
  basename and pid.  [ruby-talk:196272]
* parse.y (do_block): remove -> style block.

* parse.y (parser_yylex): remove tLAMBDA_ARG.

* eval.c (rb_call0): binding for the return event hook should have
  consistent scope.  [ruby-core:07928]

* eval.c (proc_invoke): return behavior should depend whether it
  is surrounded by a lambda or a mere block.

* eval.c (formal_assign): handles post splat arguments.

* eval.c (rb_call0): ditto.

* st.c (strhash): use FNV-1a hash.

* parse.y (parser_yylex): removed experimental ';;' terminator.

* eval.c (rb_node_arity): should be aware of post splat arguments.

* eval.c (rb_proc_arity): ditto.

* parse.y (f_args): syntax rule enhanced to support arguments
  after the splat.

* parse.y (block_param): ditto for block parameters.

* parse.y (f_post_arg): mandatory formal arguments after the splat
  argument.

* parse.y (new_args_gen): generate nodes for mandatory formal
  arguments after the splat argument.

* eval.c (rb_eval): dispatch mandatory formal arguments after the
  splat argument.

* parse.y (args): allow more than one splat in the argument list.

* parse.y (method_call): allow aref [] to accept all kind of
  method argument, including assocs, splat, and block argument.

* eval.c (SETUP_ARGS0): prepare block argument as well.

* lib/mathn.rb (Integer): remove Integer#gcd2. [ruby-core:07931]

* eval.c (error_line): print receivers true/false/nil specially.

* eval.c (rb_proc_yield): handles parameters in yield semantics.

* eval.c (nil_yield): gives LocalJumpError to denote no block
  error.

* io.c (rb_io_getc): now takes one-character string.

* string.c (rb_str_hash): use FNV-1a hash from Fowler/Noll/Vo
  hashing algorithm.

* string.c (rb_str_aref): str[0] now returns 1 character string,
  instead of a fixnum.	[Ruby2]

* parse.y (parser_yylex): ?c now returns 1 character string,
  instead of a fixnum.	[Ruby2]

* string.c (rb_str_aset): no longer support fixnum insertion.

* eval.c (umethod_bind): should not update original class.
  [ruby-dev:28636]

* eval.c (ev_const_get): should support constant access from
  within instance_eval().  [ruby-dev:28327]

* time.c (time_timeval): should round for usec floating
  number.  [ruby-core:07896]

* time.c (time_add): ditto.

* dir.c (sys_warning): should not call a vararg function
  rb_sys_warning() indirectly.	[ruby-core:07886]

* numeric.c (flo_divmod): the first element of Float#divmod should
  be an integer. [ruby-dev:28589]

* test/ruby/test_float.rb: add tests for divmod, div, modulo and remainder.

* re.c (rb_reg_initialize): should not allow modifying literal
  regexps.  frozen check moved from rb_reg_initialize_m as well.

* re.c (rb_reg_initialize): should not modify untainted objects in
  safe levels higher than 3.

* re.c (rb_memcmp): type change from char* to const void*.

* dir.c (dir_close): should not close untainted dir stream.

* dir.c (GetDIR): add tainted/frozen check for each dir operation.

* lib/rdoc/parsers/parse_rb.rb (RDoc::RubyParser::parse_symbol_arg):
  typo fixed.  a patch from Florian Gross <florg at florg.net>.

* eval.c (EXEC_EVENT_HOOK): trace_func may remove itself from
  event_hooks.	no guarantee for arbitrary hook deletion.
  [ruby-dev:28632]

* util.c (ruby_strtod): differ addition to minimize error.
  [ruby-dev:28619]

* util.c (ruby_strtod): should not raise ERANGE when the input
  string does not have any digits.  [ruby-dev:28629]

* eval.c (proc_invoke): should restore old ruby_frame->block.
  thanks to ts <decoux at moulon.inra.fr>.  [ruby-core:07833]
  also fix [ruby-dev:28614] as well.

* signal.c (trap): sig should be less then NSIG.  Coverity found
  this bug.  a patch from Kevin Tew <tewk at tewk.com>.
  [ruby-core:07823]

* math.c (math_log2): add new method inspired by
  [ruby-talk:191237].

* math.c (math_log): add optional base argument to Math::log().
  [ruby-talk:191308]

* ext/syck/emitter.c (syck_scan_scalar): avoid accessing
  uninitialized array element.	a patch from Pat Eyler
  <rubypate at gmail.com>.  [ruby-core:07809]

* array.c (rb_ary_fill): initialize local variables first.  a
  patch from Pat Eyler <rubypate at gmail.com>.	 [ruby-core:07810]

* ext/syck/yaml2byte.c (syck_yaml2byte_handler): need to free
  type_tag.  a patch from Pat Eyler <rubypate at gmail.com>.
  [ruby-core:07808]

* ext/socket/socket.c (make_hostent_internal): accept ai_family
  check from Sam Roberts <sroberts at uniserve.com>.
  [ruby-core:07691]

* util.c (ruby_strtod): should not cut off 18 digits for no
  reason.  [ruby-core:07796]

* array.c (rb_ary_fill): internalize local variable "beg" to
  pacify Coverity.  [ruby-core:07770]

* pack.c (pack_unpack): now supports CRLF newlines.  a patch from
  <tommy at tmtm.org>.	[ruby-dev:28601]

* applied code clean-up patch from Stefan Huehner
  <stefan at huehner.org>.  [ruby-core:07764]

* lib/jcode.rb (String::tr_s): should have translated non
  squeezing character sequence (i.e. a character) as well.  thanks
  to Hiroshi Ichikawa <gimite at gimite.ddo.jp> [ruby-list:42090]

* ext/socket/socket.c: document update patch from Sam Roberts
  <sroberts at uniserve.com>.  [ruby-core:07701]

* lib/mathn.rb (Integer): need not to remove gcd2.  a patch from
  NARUSE, Yui <naruse at airemix.com>.	[ruby-dev:28570]

* parse.y (arg): too much NEW_LIST()

* eval.c (SETUP_ARGS0): remove unnecessary access to nd_alen.

* eval.c (rb_eval): use ARGSCAT for NODE_OP_ASGN1.
  [ruby-dev:28585]

* parse.y (arg): use NODE_ARGSCAT for placeholder.

* lib/getoptlong.rb (GetoptLong::get): RDoc update patch from
  mathew <meta at pobox.com>.  [ruby-core:07738]

* variable.c (rb_const_set): raise error when no target klass is
  supplied.  [ruby-dev:28582]

* prec.c (prec_prec_f): documentation patch from
  <gerardo.santana at gmail.com>.  [ruby-core:07689]

* bignum.c (rb_big_pow): second operand may be too big even if
  it's a Fixnum.  [ruby-talk:187984]

* README.EXT: update symbol description.  [ruby-talk:188104]

* COPYING: explicitly note GPLv2.  [ruby-talk:187922]

* parse.y: remove some obsolete syntax rules (unparenthesized
  method calls in argument list).

* eval.c (rb_call0): insecure calling should be checked for non
  NODE_SCOPE method invocations too.

* eval.c (rb_alias): should preserve the current safe level as
  well as method definition.

* process.c (rb_f_sleep): remove RDoc description about SIGALRM
  which is not valid on the current implementation. [ruby-dev:28464]

 Thu Mar 23 21:40:47 2006  K.Kosako  <sndgk393 AT ybb.ne.jp>

* eval.c (method_missing): should support argument splat in
  super.  a bug in combination of super, splat and
  method_missing.  [ruby-talk:185438]

* configure.in: Solaris SunPro compiler -rapth patch from
  <kuwa at labs.fujitsu.com>.  [ruby-dev:28443]

* configure.in: remove enable_rpath=no for Solaris.
  [ruby-dev:28440]

* ext/win32ole/win32ole.c (ole_val2olevariantdata): change behavior
  of converting  OLE Variant object with VT_ARRAY|VT_UI1 and Ruby
  String object.

* ruby.1: a clarification patch from David Lutterkort
  <dlutter at redhat.com>.  [ruby-core:7508]

* lib/rdoc/ri/ri_paths.rb (RI::Paths): adding paths from rubygems
  directories.	a patch from Eric Hodel <drbrain at segment7.net>.
  [ruby-core:07423]

* eval.c (rb_clear_cache_by_class): clearing wrong cache.

* ext/extmk.rb: use :remove_destination to install extension libraries
  to avoid SEGV.  [ruby-dev:28417]

* eval.c (rb_thread_fd_writable): should not re-schedule output
  from KILLED thread (must be error printing).

* array.c (rb_ary_flatten_bang): allow specifying recursion
  level.  [ruby-talk:182170]

* array.c (rb_ary_flatten): ditto.

* gc.c (add_heap): a heap_slots may overflow.  a patch from Stefan
  Weil <weil at mail.berlios.de>.

* eval.c (rb_call): use separate cache for fcall/vcall
  invocation.

* eval.c (rb_eval): NODE_FCALL, NODE_VCALL can call local
  functions.

* eval.c (rb_mod_local): a new method to specify newly added
  visibility "local".

* eval.c (search_method): search for local methods which are
  visible only from the current class.

* class.c (rb_class_local_methods): a method to list local methods.

* object.c (Init_Object): add BasicObject class as a top level
  BlankSlate class.

* ruby.h (SYM2ID): should not cast to signed long.
  [ruby-core:07414]

* class.c (rb_include_module): allow module duplication.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@10235 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 23 insertions, 15 deletions

diff --git a/re.c b/re.c
index 08df5b38f3..8730723b91 100644
--- a/re.c
+++ b/re.c
@@ -76,8 +76,9 @@ static const char casetable[] = {
 #endif
 
 int
-rb_memcicmp(char *p1, char *p2, long len)
+rb_memcicmp(const void *x, const void *y, long len)
 {
+    const unsigned char *p1 = x, *p2 = y;
     int tmp;
 
     while (len--) {
@@ -88,7 +89,7 @@ rb_memcicmp(char *p1, char *p2, long len)
 }
 
 int
-rb_memcmp(char *p1, char *p2, long len)
+rb_memcmp(const void *p1, const void *p2, long len)
 {
     if (!ruby_ignorecase) {
 	return memcmp(p1, p2, len);
@@ -97,10 +98,10 @@ rb_memcmp(char *p1, char *p2, long len)
 }
 
 long
-rb_memsearch(char *x0, long m, char *y0, long n)
+rb_memsearch(const void *x0, long m, const void *y0, long n)
 {
-    unsigned char *x = (unsigned char *)x0, *y = (unsigned char *)y0;
-    unsigned char *s, *e;
+    const unsigned char *x = x0, *y = y0;
+    const unsigned char *s, *e;
     long i;
     int d;
     unsigned long hx, hy;
@@ -151,7 +152,9 @@ rb_memsearch(char *x0, long m, char *y0, long n)
     return s-y;
 }
 
+#define REG_LITERAL FL_USER5
 #define REG_CASESTATE  FL_USER0
+
 #define KCODE_NONE  0
 #define KCODE_EUC   FL_USER1
 #define KCODE_SJIS  FL_USER2
@@ -167,10 +170,8 @@ rb_memsearch(char *x0, long m, char *y0, long n)
 #define ARG_KCODE_UTF8       (ARG_KCODE_UNIT * 4)
 #define ARG_KCODE_MASK       (ARG_KCODE_UNIT * 7)
 
-
 static int reg_kcode = DEFAULT_KCODE;
 
-
 static int char_to_option(int c)
 {
   int val;
@@ -505,13 +506,13 @@ rb_reg_to_s(VALUE re)
     int options, opt;
     const int embeddable = ONIG_OPTION_MULTILINE|ONIG_OPTION_IGNORECASE|ONIG_OPTION_EXTEND;
     long len;
-    const char* ptr;
+    const UChar* ptr;
     VALUE str = rb_str_buf_new2("(?");
 
     rb_reg_check(re);
 
     options = RREGEXP(re)->ptr->options;
-    ptr = RREGEXP(re)->str;
+    ptr = (UChar*)RREGEXP(re)->str;
     len = RREGEXP(re)->len;
   again:
     if (len >= 4 && ptr[0] == '(' && ptr[1] == '?') {
@@ -566,7 +567,7 @@ rb_reg_to_s(VALUE re)
 	}
 	if (err) {
 	    options = RREGEXP(re)->ptr->options;
-	    ptr = RREGEXP(re)->str;
+	    ptr = (UChar*)RREGEXP(re)->str;
 	    len = RREGEXP(re)->len;
 	}
     }
@@ -583,7 +584,7 @@ rb_reg_to_s(VALUE re)
     }
 
     rb_str_buf_cat2(str, ":");
-    rb_reg_expr_str(str, ptr, len);
+    rb_reg_expr_str(str, (char*)ptr, len);
     rb_str_buf_cat2(str, ")");
 
     OBJ_INFECT(str, re);
@@ -1247,12 +1248,12 @@ match_captures(VALUE match)
 }
 
 static int
-name_to_backref_number(struct re_registers *regs, VALUE regexp, char* name, char* name_end)
+name_to_backref_number(struct re_registers *regs, VALUE regexp, const char* name, const char* name_end)
 {
   int num;
 
   num = onig_name_to_backref_number(RREGEXP(regexp)->ptr,
-            (unsigned char* )name, (unsigned char* )name_end, regs);
+            (const unsigned char* )name, (const unsigned char* )name_end, regs);
   if (num >= 1) {
     return num;
   }
@@ -1301,7 +1302,7 @@ match_aref(int argc, VALUE *argv, VALUE match)
         }
       }
       else {
-        char *p;
+        const char *p;
         int num;
 
         switch (TYPE(idx)) {
@@ -1336,6 +1337,8 @@ match_entry(VALUE match, long n)
 
 /*
  *  call-seq:
+    if (!OBJ_TAINTED(obj) && rb_safe_level() >= 4)
+	rb_raise(rb_eSecurityError, "Insecure: can't modify regexp");
  *     mtch.select([index]*)   => array
  *  
  *  Uses each <i>index</i> to access the matching values, returning an array of
@@ -1437,6 +1440,11 @@ rb_reg_initialize(VALUE obj, const char *s, long len,
 {
     struct RRegexp *re = RREGEXP(obj);
 
+    if (!OBJ_TAINTED(obj) && rb_safe_level() >= 4)
+	rb_raise(rb_eSecurityError, "Insecure: can't modify regexp");
+    rb_check_frozen(obj);
+    if (FL_TEST(obj, REG_LITERAL))
+	rb_raise(rb_eSecurityError, "can't modify literal regexp");
     if (re->ptr) onig_free(re->ptr);
     if (re->str) free(re->str);
     re->ptr = 0;
@@ -1459,6 +1467,7 @@ rb_reg_initialize(VALUE obj, const char *s, long len,
     if (options & ARG_KCODE_MASK) {
 	kcode_reset_option();
     }
+    if (ce) FL_SET(obj, REG_LITERAL);
 }
 
 static VALUE
@@ -1760,7 +1769,6 @@ rb_reg_initialize_m(int argc, VALUE *argv, VALUE self)
     long len;
     int flags = 0;
 
-    rb_check_frozen(self);
     if (argc == 0 || argc > 3) {
 	rb_raise(rb_eArgError, "wrong number of arguments");
     }