From 8e2d0deb88c4c9539b5c963da8cfad2e8205298e Mon Sep 17 00:00:00 2001
From: normal <normal@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 25 Jul 2017 05:55:22 +0000
Subject: [PATCH] dir.c (ruby_brace_expand): RB_GC_GUARD safety

The lifetime of a String VALUE must match or exceed the lifetime
of its R*_PTR result; otherwise the GC can while reclaim the
VALUE while the R*_PTR result is in use.

* dir.c (ruby_brace_expand): add var parameter for GC guard
  (ruby_brace_glob_with_enc): adjust call
  (file_s_fnmatch): ditto
  (push_glob): remove misplaced GC guard

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59416 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 dir.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dir.c b/dir.c
index 3db196fef9..017f715080 100644
--- a/dir.c
+++ b/dir.c
@@ -2268,7 +2268,7 @@ push_pattern(const char *path, VALUE ary, void *enc)
 
 static int
 ruby_brace_expand(const char *str, int flags, ruby_glob_func *func, VALUE arg,
-		  rb_encoding *enc)
+		  rb_encoding *enc, VALUE var)
 {
     const int escape = !(flags & FNM_NOESCAPE);
     const char *p = str;
@@ -2313,7 +2313,7 @@ ruby_brace_expand(const char *str, int flags, ruby_glob_func *func, VALUE arg,
 	    }
 	    memcpy(buf+shift, t, p-t);
 	    strlcpy(buf+shift+(p-t), rbrace+1, len-(shift+(p-t)));
-	    status = ruby_brace_expand(buf, flags, func, arg, enc);
+	    status = ruby_brace_expand(buf, flags, func, arg, enc, var);
 	    if (status) break;
 	}
 	GLOB_FREE(buf);
@@ -2322,6 +2322,7 @@ ruby_brace_expand(const char *str, int flags, ruby_glob_func *func, VALUE arg,
 	status = glob_call_func(func, s, arg, enc);
     }
 
+    RB_GC_GUARD(var);
     return status;
 }
 
@@ -2349,7 +2350,7 @@ ruby_brace_glob_with_enc(const char *str, int flags, ruby_glob_func *func, VALUE
     args.funcs.error = NULL;
     args.value = arg;
     args.flags = flags;
-    return ruby_brace_expand(str, flags, glob_brace, (VALUE)&args, enc);
+    return ruby_brace_expand(str, flags, glob_brace, (VALUE)&args, enc, Qfalse);
 }
 
 int
@@ -2409,9 +2410,8 @@ push_glob(VALUE ary, VALUE str, VALUE base, int flags)
     enc = rb_utf8_encoding();
 #endif
 
-    RB_GC_GUARD(str);
     return ruby_brace_expand(RSTRING_PTR(str), flags,
-			     push_caller, (VALUE)&args, enc);
+			     push_caller, (VALUE)&args, enc, str);
 }
 
 static VALUE
@@ -2905,7 +2905,7 @@ file_s_fnmatch(int argc, VALUE *argv, VALUE obj)
 	args.value = path;
 	args.flags = flags;
 	if (ruby_brace_expand(RSTRING_PTR(pattern), flags, fnmatch_brace,
-			      (VALUE)&args, rb_enc_get(pattern)) > 0)
+			      (VALUE)&args, rb_enc_get(pattern), pattern) > 0)
 	    return Qtrue;
     }
     else {