diff options
-rw-r--r-- | pack.c | 7 | ||||
-rw-r--r-- | test/ruby/test_pack.rb | 16 | ||||
-rw-r--r-- | version.h | 6 |
3 files changed, 26 insertions, 3 deletions
@@ -761,6 +761,7 @@ pack_pack(int argc, VALUE *argv, VALUE ary) StringValue(from); ptr = RSTRING_PTR(from); plen = RSTRING_LEN(from); + OBJ_INFECT(res, from); if (len == 0 && type == 'm') { encodes(res, ptr, plen, type, 0); @@ -788,6 +789,7 @@ pack_pack(int argc, VALUE *argv, VALUE ary) case 'M': /* quoted-printable encoded string */ from = rb_obj_as_string(NEXTFROM); + OBJ_INFECT(res, from); if (len <= 1) len = 72; qpencode(res, from, len); @@ -813,6 +815,7 @@ pack_pack(int argc, VALUE *argv, VALUE ary) } else { t = StringValuePtr(from); + OBJ_INFECT(res, from); rb_obj_taint(from); } if (!associates) { @@ -1195,6 +1198,7 @@ pack_unpack_internal(VALUE str, VALUE fmt, int mode) len = (send - s) * 8; bits = 0; bitstr = rb_usascii_str_new(0, len); + OBJ_INFECT(bitstr, str); t = RSTRING_PTR(bitstr); for (i=0; i<len; i++) { if (i & 7) bits >>= 1; @@ -1216,6 +1220,7 @@ pack_unpack_internal(VALUE str, VALUE fmt, int mode) len = (send - s) * 8; bits = 0; bitstr = rb_usascii_str_new(0, len); + OBJ_INFECT(bitstr, str); t = RSTRING_PTR(bitstr); for (i=0; i<len; i++) { if (i & 7) bits <<= 1; @@ -1237,6 +1242,7 @@ pack_unpack_internal(VALUE str, VALUE fmt, int mode) len = (send - s) * 2; bits = 0; bitstr = rb_usascii_str_new(0, len); + OBJ_INFECT(bitstr, str); t = RSTRING_PTR(bitstr); for (i=0; i<len; i++) { if (i & 1) @@ -1260,6 +1266,7 @@ pack_unpack_internal(VALUE str, VALUE fmt, int mode) len = (send - s) * 2; bits = 0; bitstr = rb_usascii_str_new(0, len); + OBJ_INFECT(bitstr, str); t = RSTRING_PTR(bitstr); for (i=0; i<len; i++) { if (i & 1) diff --git a/test/ruby/test_pack.rb b/test/ruby/test_pack.rb index ce2682ee59..3d3415eee4 100644 --- a/test/ruby/test_pack.rb +++ b/test/ruby/test_pack.rb @@ -860,4 +860,20 @@ EXPECTED assert_equal "hogefuga", "aG9nZWZ1Z2E=".unpack1("m") assert_equal "01000001", "A".unpack1("B*") end + + def test_pack_infection + tainted_array_string = ["123456"] + tainted_array_string.first.taint + ['a', 'A', 'Z', 'B', 'b', 'H', 'h', 'u', 'M', 'm', 'P', 'p'].each do |f| + assert_predicate(tainted_array_string.pack(f), :tainted?) + end + end + + def test_unpack_infection + tainted_string = "123456" + tainted_string.taint + ['a', 'A', 'Z', 'B', 'b', 'H', 'h', 'u', 'M', 'm'].each do |f| + assert_predicate(tainted_string.unpack(f).first, :tainted?) + end + end end @@ -1,10 +1,10 @@ #define RUBY_VERSION "2.4.5" -#define RUBY_RELEASE_DATE "2018-10-17" -#define RUBY_PATCHLEVEL 333 +#define RUBY_RELEASE_DATE "2018-10-18" +#define RUBY_PATCHLEVEL 334 #define RUBY_RELEASE_YEAR 2018 #define RUBY_RELEASE_MONTH 10 -#define RUBY_RELEASE_DAY 17 +#define RUBY_RELEASE_DAY 18 #include "ruby/version.h" |