merge revision(s) 53153:

	* ext/fiddle/handle.c: check tainted string arguments.
	  Patch provided by tenderlove and nobu.

	* test/fiddle/test_handle.rb (class TestHandle): add test for above.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@53154 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 17 insertions, 0 deletions

diff --git a/test/fiddle/test_handle.rb b/test/fiddle/test_handle.rb
index ffbde41626..93a78287f3 100644
--- a/test/fiddle/test_handle.rb
+++ b/test/fiddle/test_handle.rb
@@ -9,6 +9,23 @@ module Fiddle
 
     include Test::Unit::Assertions
 
+    def test_safe_handle_open
+      t = Thread.new do
+        $SAFE = 1
+        Fiddle::Handle.new(LIBC_SO.taint)
+      end
+      assert_raise(SecurityError) { t.value }
+    end
+
+    def test_safe_function_lookup
+      t = Thread.new do
+        h = Fiddle::Handle.new(LIBC_SO)
+        $SAFE = 1
+        h["qsort".taint]
+      end
+      assert_raise(SecurityError) { t.value }
+    end
+
     def test_to_i
       handle = Fiddle::Handle.new(LIBC_SO)
       assert_kind_of Integer, handle.to_i