* string.c (RESIZE_CAPA): check string attribute before modifying

  capacity member of string structure.  [ruby-dev:24594]

* ext/zlib/zlib.c (gzreader_gets): use memchr() to to gain
  performance.  [ruby-talk:117701]

* sprintf.c (rb_f_sprintf): raise ArgumentError for extra
  arguments, unless (digit)$ style used.

* ext/zlib/zlib.c (gzreader_gets): use memchr() to to gain
  performance.  [ruby-talk:117701]

* sprintf.c (rb_f_sprintf): raise ArgumentError for extra
  arguments, unless (digit)$ style used.

* eval.c (frame_free): Guy Decoux solved the leak problem.
  Thanks.  [ruby-core:03549]

* ext/zlib/zlib.c (zstream_append_input): clear klass for z->input
  to avoid potential vulnerability.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@7119 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 11 insertions, 9 deletions

diff --git a/string.c b/string.c
index 5177e63ad9..6a0e91a188 100644
--- a/string.c
+++ b/string.c
@@ -28,10 +28,12 @@
 VALUE rb_cString;
 
 #define STR_ASSOC   FL_USER3
+#define STR_NOCAPA  (ELTS_SHARED|STR_ASSOC)
 
 #define RESIZE_CAPA(str,capacity) do {\
     REALLOC_N(RSTRING(str)->ptr, char, (capacity)+1);\
-    RSTRING(str)->aux.capa = (capacity);\
+    if (!FL_TEST(str, STR_NOCAPA))\
+        RSTRING(str)->aux.capa = (capacity);\
 } while (0)
 
 VALUE rb_fs;
@@ -253,14 +255,14 @@ rb_str_shared_replace(str, str2)
 	RSTRING(str)->ptr = 0;
 	RSTRING(str)->len = 0;
 	RSTRING(str)->aux.capa = 0;
-	FL_UNSET(str, ELTS_SHARED|STR_ASSOC);
+	FL_UNSET(str, STR_NOCAPA);
 	return;
     }
     RSTRING(str)->ptr = RSTRING(str2)->ptr;
     RSTRING(str)->len = RSTRING(str2)->len;
-    FL_UNSET(str, ELTS_SHARED|STR_ASSOC);
-    if (FL_TEST(str2, ELTS_SHARED|STR_ASSOC)) {
-	FL_SET(str, RBASIC(str2)->flags & (ELTS_SHARED|STR_ASSOC));
+    FL_UNSET(str, STR_NOCAPA);
+    if (FL_TEST(str2, STR_NOCAPA)) {
+	FL_SET(str, RBASIC(str2)->flags & STR_NOCAPA);
 	RSTRING(str)->aux.shared = RSTRING(str2)->aux.shared;
     }
     else {
@@ -269,7 +271,7 @@ rb_str_shared_replace(str, str2)
     RSTRING(str2)->ptr = 0;	/* abandon str2 */
     RSTRING(str2)->len = 0;
     RSTRING(str2)->aux.capa = 0;
-    FL_UNSET(str2, ELTS_SHARED|STR_ASSOC);
+    FL_UNSET(str2, STR_NOCAPA);
     if (OBJ_TAINTED(str2)) OBJ_TAINT(str);
 }
 
@@ -480,7 +482,7 @@ str_make_independent(str)
     ptr[RSTRING(str)->len] = 0;
     RSTRING(str)->ptr = ptr;
     RSTRING(str)->aux.capa = RSTRING(str)->len;
-    FL_UNSET(str, ELTS_SHARED|STR_ASSOC);
+    FL_UNSET(str, STR_NOCAPA);
 }
 
 void
@@ -643,7 +645,7 @@ rb_str_resize(str, len)
 	rb_str_modify(str);
 	if (RSTRING(str)->len < len || RSTRING(str)->len - len > 1024) {
 	    REALLOC_N(RSTRING(str)->ptr, char, len+1);
-	    if (!FL_TEST(str, STR_ASSOC|ELTS_SHARED)) {
+	    if (!FL_TEST(str, STR_NOCAPA)) {
 		RSTRING(str)->aux.capa = len;
 	    }
 	}
@@ -1605,7 +1607,7 @@ rb_str_splice(str, beg, len, val)
     StringValue(val);
     if (len < RSTRING(val)->len) {
 	/* expand string */
-	RESIZE_CAPA(str, RSTRING(str)->len + RSTRING(val)->len - len);
+	RESIZE_CAPA(str, RSTRING(str)->len + RSTRING(val)->len - len + 1);
     }
 
     if (RSTRING(val)->len != len) {