From: noreply@...
Date: 2005-10-25T13:57:32+09:00
Subject: [ ruby-Bugs-2714 ] YAML dumps core (with pp)

Bugs item #2714, was opened at 2005-10-25 04:48
You can respond by visiting: 
http://rubyforge.org/tracker/?func=detail&atid=1698&aid=2714&group_id=426

Category: Standard Library
Group: None
Status: Open
Resolution: None
Priority: 4
Submitted By: Hirokazu Yamamoto (ocean)
Assigned to: Nobody (None)
Summary: YAML dumps core (with pp)

Initial Comment:
This bug was originally reported by sheepman. [ruby-dev:27384]

require "yaml"
require "pp"
y = YAML.load <<HERE
!tag:yaml.org,2002:str foo :
HERE
pp y

dumps core. This comes from double freeing in syck module.

* ext/syck/implicit.c (syck_type_id_to_uri): should return
  newly allocated memory. otherwise, type_id will be freed
  twice.

Index: implicit.c
===================================================================
RCS file: /src/ruby/ext/syck/implicit.c,v
retrieving revision 1.12.2.8
diff -u -w -b -p -r1.12.2.8 implicit.c
--- implicit.c	20 Sep 2005 06:46:43 -0000	1.12.2.8
+++ implicit.c	23 Oct 2005 06:29:20 -0000
@@ -2481,7 +2481,7 @@ yy244:	++YYCURSOR;
 	goto yy245;
 yy245:
 #line 174 "implicit.re"
-{   return type_id; }
+{   return syck_strndup( type_id, strlen( type_id ) ); }
 #line 2485 "<stdout>"
 yy246:	yych = *++YYCURSOR;
 	switch(yych){
@@ -2928,7 +2928,7 @@ yy264:	++YYCURSOR;
 	goto yy265;
 yy265:
 #line 172 "implicit.re"
-{   return type_id; }
+{   return syck_strndup( type_id, strlen( type_id ) ); }
 #line 2932 "<stdout>"
 yy266:	yych = *++YYCURSOR;
 	switch(yych){

But after applied this patch, above sample script reported error
like this.

E:/ruby-cvs/ruby_1_8/lib/yaml/rubytypes.rb:154:in `initialize': can't convert ni
l into String (TypeError)
        from E:/ruby-cvs/ruby_1_8/lib/yaml/rubytypes.rb:154:in `yaml_new'
        from E:/ruby-cvs/ruby_1_8/lib/yaml.rb:133:in `load'
        from /z.rb:3

I don't know this is intended behavior or not.


----------------------------------------------------------------------

You can respond by visiting: 
http://rubyforge.org/tracker/?func=detail&atid=1698&aid=2714&group_id=426