variable.c: consider length

* variable.c (rb_path_to_class): consider the string length
  instead of a terminator.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55449 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,4 +1,7 @@
-Sun Jun 19 10:54:40 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+Sun Jun 19 11:19:43 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* variable.c (rb_path_to_class): consider the string length
+	  instead of a terminator.
 
 	* variable.c (rb_path_to_class): search the constant at once
 	  instead of checking if defined and then getting it.

test/ruby/test_marshal.rb

@@ -719,10 +719,12 @@ class TestMarshal < Test::Unit::TestCase
   end
 
   def test_marshal_load_extended_class_crash
-    crash = "\x04\be:\x0F\x00omparableo:\vObject\x00"
+    assert_separately([], "#{<<-"begin;"}\n#{<<-"end;"}")
-
+    begin;
-    opt = %w[--disable=gems]
+      assert_raise_with_message(ArgumentError, /undefined/) do
-    assert_ruby_status(opt, "Marshal.load(#{crash.dump})")
+        Marshal.load("\x04\be:\x0F\x00omparableo:\vObject\x00")
+      end
+    end;
   end
 
   def test_marshal_load_r_prepare_reference_crash

variable.c

@@ -389,7 +389,7 @@ VALUE
 rb_path_to_class(VALUE pathname)
 {
     rb_encoding *enc = rb_enc_get(pathname);
-    const char *pbeg, *p, *path = RSTRING_PTR(pathname);
+    const char *pbeg, *pend, *p, *path = RSTRING_PTR(pathname);
     ID id;
     VALUE c = rb_cObject;
 
@@ -397,15 +397,16 @@ rb_path_to_class(VALUE pathname)
 	rb_raise(rb_eArgError, "invalid class path encoding (non ASCII)");
     }
     pbeg = p = path;
-    if (path[0] == '#') {
+    pend = path + RSTRING_LEN(pathname);
+    if (path == pend || path[0] == '#') {
 	rb_raise(rb_eArgError, "can't retrieve anonymous class %"PRIsVALUE,
 		 QUOTE(pathname));
     }
-    while (*p) {
+    while (p < pend) {
-	while (*p && *p != ':') p++;
+	while (p < pend && *p != ':') p++;
 	id = rb_check_id_cstr(pbeg, p-pbeg, enc);
-	if (p[0] == ':') {
+	if (p < pend && p[0] == ':') {
-	    if (p[1] != ':') goto undefined_class;
+	    if ((size_t)(pend - p) < 2 || p[1] != ':') goto undefined_class;
 	    p += 2;
 	    pbeg = p;
 	}