* thread.c (update_coverage): Do not track coverage in loaded files

after Coverage.result. Avoids out-of-bounds access. [Bug #12237]
* ext/coverage/coverage.c (coverage_clear_result_i): document.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54465 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,10 @@
+Fri Apr  1 01:13:55 2016  Benoit Daloze  <eregontp@gmail.com>
+
+	* thread.c (update_coverage): Do not track coverage in loaded files
+	  after Coverage.result. Avoids out-of-bounds access. [Bug #12237]
+
+	* ext/coverage/coverage.c (coverage_clear_result_i): document.
+
 Thu Mar 31 19:16:16 2016  Koichi Sasada  <ko1@atdot.net>
 
 	* gc.c: need to set initial value of GC_HEAP_FREE_SLOTS_GOAL_RATIO.

ext/coverage/coverage.c

@@ -32,6 +32,7 @@ rb_coverage_start(VALUE klass)
     return Qnil;
 }
 
+/* Make coverage arrays empty so old covered files are no longer tracked. */
 static int
 coverage_clear_result_i(st_data_t key, st_data_t val, st_data_t h)
 {

thread.c

@@ -4777,7 +4777,7 @@ update_coverage(rb_event_flag_t event, VALUE proc, VALUE self, ID id, VALUE klas
     if (RB_TYPE_P(coverage, T_ARRAY) && !RBASIC_CLASS(coverage)) {
 	long line = rb_sourceline() - 1;
 	long count;
-	if (RARRAY_AREF(coverage, line) == Qnil) {
+	if (line >= RARRAY_LEN(coverage)) { /* no longer tracked */
 	    return;
 	}
 	count = FIX2LONG(RARRAY_AREF(coverage, line)) + 1;