* io.c (rb_f_syscall): should check argument string taint before

invoking system calls.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@28296 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,8 @@
+Sat Jun 12 10:02:26 2010  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* io.c (rb_f_syscall): should check argument string taint before
+	  invoking system calls.
+
 Sat Jun 12 09:18:31 2010  Yukihiro Matsumoto  <matz@ruby-lang.org>
 
 	* variable.c (uninitialized_constant): process through

io.c

@@ -7520,7 +7520,7 @@ rb_f_syscall(int argc, VALUE *argv)
 	VALUE v = rb_check_string_type(*argv);
 
 	if (!NIL_P(v)) {
-	    StringValue(v);
+	    SafeStringValue(v);
 	    rb_str_modify(v);
 	    arg[i] = (unsigned long)StringValueCStr(v);
 	}