[ruby-dev:24548] Zlib::Deflate#avail_out= causes core dump

次のようにすると core を吐きます。

% ./ruby -rzlib -e '  
d = Zlib::Deflate.new
d.avail_out = 10
d << "abcdezzzz"
out = nil
ObjectSpace.each_object(String) {|s| out = s if /\Ax\234/ =~ s }
while out.length < 0x20000
  d << rand.to_s
end
out.replace ""
d << "abc"
p d.flush
'
-e:12: [BUG] Segmentation fault
ruby 1.9.0 (2004-10-20) [i686-linux]

zsh: abort (core dumped)  ./ruby -rzlib -e 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -rzlib -e 
d = Zlib::Deflate.new
d.avail_out = 10
d << "abcdezzzz"
out ='.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /home/akr/ruby/tmp-ruby/lib/ruby/1.9/i686-linux/zlib.so...done.
Loaded symbols for /home/akr/ruby/tmp-ruby/lib/ruby/1.9/i686-linux/zlib.so
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
#0  0x4009e741 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e741 in kill () from /lib/libc.so.6
#1  0x4009e4c5 in raise () from /lib/libc.so.6
#2  0x4009fa08 in abort () from /lib/libc.so.6
#3  0x080d2476 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b0422 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  0x400ecaa7 in memcpy () from /lib/libc.so.6
#7  0x401e8df7 in deflateCopy () from /usr/lib/libz.so.1
#8  0x401e75d6 in deflate () from /usr/lib/libz.so.1
#9  0x4001aa33 in zstream_run (z=0x12, src=0x81b6852 <Address 0x81b6852 out of bounds>, len=150, flush=2) at zlib.c:715
#10 0x4001b8dc in rb_deflate_flush (argc=150, argv=0x96, obj=1075602156) at zlib.c:1303
#11 0x0806a03a in call_cfunc (func=0x4001b810 <rb_deflate_flush>, recv=1075602156, len=136013906, argc=2, argv=0x0)
    at eval.c:5376
#12 0x0805e1a7 in rb_call0 (klass=1075606976, recv=1075602156, id=7617, oid=150, argc=0, argv=0x0, body=0x401c7494, 
    nosuper=0) at eval.c:5517
#13 0x0805e458 in rb_call (klass=1075606976, recv=1075602156, mid=7617, argc=0, argv=0x0, scope=0) at eval.c:5738
#14 0x08059398 in rb_eval (self=1075673496, n=0x96) at ruby.h:635
#15 0x080596c8 in rb_eval (self=1075673496, n=0x96) at ruby.h:664
#16 0x080558dd in ruby_exec_internal () at eval.c:1457
#17 0x080558f6 in ruby_exec () at eval.c:1475
#18 0x08055940 in ruby_run () at eval.c:1492
#19 0x080539e5 in main (argc=150, argv=0x96, envp=0xbffff8b8) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]