From: nobu@...
Date: 2004-10-04T09:57:28+09:00
Subject: [ruby-dev:24415] Re: open dumps core

なかだです。

At Mon, 4 Oct 2004 00:00:21 +0900,
Tanaka Akira wrote in [ruby-dev:24408]:
> 
> 次のようにすると core を吐きます。
> 
> % ./ruby -e '
> def fin(&block) ObjectSpace.define_finalizer(Object.new, &block) end
> f = [File.open("/dev/null")]
> begin
>   loop { File.sysopen("/dev/null") }
> rescue Errno::EMFILE
> end
> f.clear
> mode = "\0" * 0x20000
> mode[0,1] = "r"
> fin { mode.replace "" }
> p open("/dev/null", mode)
> '

あとはARGFかなぁ。


Index: io.c
===================================================================
RCS file: /cvs/ruby/src/ruby/io.c,v
retrieving revision 1.293
diff -u -2 -p -r1.293 io.c
--- io.c	1 Oct 2004 15:56:04 -0000	1.293
+++ io.c	4 Oct 2004 00:51:42 -0000
@@ -2422,4 +2422,6 @@ rb_io_mode_modenum(mode)
 }
 
+#define MODENUM_MAX 4
+
 static char*
 rb_io_modenum_mode(flags, mode)
@@ -2549,10 +2551,11 @@ rb_file_open_internal(io, fname, mode)
 {
     OpenFile *fptr;
+    char mbuf[MODENUM_MAX];
 
     MakeOpenFile(io, fptr);
 
     fptr->mode = rb_io_mode_flags(mode);
-    fptr->f = rb_fopen(fname, mode);
     fptr->path = strdup(fname);
+    fptr->f = rb_fopen(fptr->path, rb_io_flags_mode(fptr->mode, mbuf));
 
     return io;
@@ -2575,5 +2578,5 @@ rb_file_sysopen_internal(io, fname, flag
     int fd;
     char *m;
-    char mbuf[4];
+    char mbuf[MODENUM_MAX];
 
     MakeOpenFile(io, fptr);
@@ -2879,5 +2882,5 @@ rb_io_popen(str, argc, argv, klass)
     char *mode;
     VALUE pname, pmode, port;
-    char mbuf[4];
+    char mbuf[MODENUM_MAX];
 
     if (rb_scan_args(argc, argv, "11", &pname, &pmode) == 1) {
@@ -2966,5 +2969,5 @@ rb_io_s_popen(argc, argv, klass)
     char *mode;
     VALUE pname, pmode, port, tmp;
-    char mbuf[4];
+    char mbuf[MODENUM_MAX];
 
     if (rb_scan_args(argc, argv, "11", &pname, &pmode) == 1) {
@@ -3354,5 +3357,5 @@ rb_io_reopen(argc, argv, file)
 {
     VALUE fname, nmode;
-    char *mode;
+    char mode[MODENUM_MAX];
     OpenFile *fptr;
 
@@ -3374,8 +3377,8 @@ rb_io_reopen(argc, argv, file)
 
     if (!NIL_P(nmode)) {
-	mode = StringValuePtr(nmode);
+	strncpy(mode, StringValuePtr(nmode), sizeof(mode));
+	mode[sizeof(mode) - 1] = 0;
     }
     else {
-	mode = ALLOCA_N(char, 4);
 	rb_io_flags_mode(fptr->mode, mode);
     }
@@ -3389,5 +3392,5 @@ rb_io_reopen(argc, argv, file)
     fptr->mode = rb_io_mode_flags(mode);
     if (!fptr->f) {
-	fptr->f = rb_fopen(RSTRING(fname)->ptr, mode);
+	fptr->f = rb_fopen(fptr->path, mode);
 	if (fptr->f2) {
 	    fclose(fptr->f2);
@@ -3949,5 +3952,5 @@ rb_io_initialize(argc, argv, io)
     OpenFile *fp, *ofp = NULL;
     int fd, flags, fmode;
-    char mbuf[4];
+    char mbuf[MODENUM_MAX];
 
     rb_secure(4);


-- 
--- 僕の前にBugはない。
--- 僕の後ろにBugはできる。
    中田 伸悦