[ruby-dev:24656] open dumps core again^2

次のようにすると core を吐きます。

% ./ruby -e '
str = "|echo aaa" + "\0" * 0x20000
mode = Object.new
class << mode; self end.send(:define_method, :to_str) {
  str.replace ""
  "r"
}
p open(str, mode)
'
-e:8: [BUG] Segmentation fault
ruby 1.9.0 (2004-10-31) [i686-linux]

zsh: abort (core dumped)  ./ruby -e 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -e 
str = "|echo aaa" + "\0" * 0x20000
mode = Object.new
class << mode;'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e6b1 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e6b1 in kill () from /lib/libc.so.6
#1  0x4009e435 in raise () from /lib/libc.so.6
#2  0x4009f978 in abort () from /lib/libc.so.6
#3  0x080d4136 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b14d2 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  0x08079454 in pipe_open (argc=0, argv=0x0, pname=0x401fa009 <Address 0x401fa009 out of bounds>, mode=0x0) at io.c:2803
#7  0x08079531 in rb_io_popen (str=0x0, argc=0, argv=0x0, klass=0) at io.c:2923
#8  0x08079b13 in rb_f_open (argc=2, argv=0xbfffeac8) at io.c:3240
#9  0x0806a52a in call_cfunc (func=0x8079a10 <rb_f_open>, recv=1075673536, len=1075814409, argc=1, argv=0xbfffeac8)
    at eval.c:5382
#10 0x0805e417 in rb_call0 (klass=1075678376, recv=1075673536, id=7353, oid=0, argc=2, argv=0xbfffeac8, body=0x401cedd4, 
    nosuper=0) at eval.c:5523
#11 0x0805e6c8 in rb_call (klass=1075678376, recv=1075673536, mid=7353, argc=2, argv=0xbfffeac8, scope=1) at eval.c:5744
#12 0x08059538 in rb_eval (self=1075673536, n=0x0) at ruby.h:633
#13 0x08059868 in rb_eval (self=1075673536, n=0x0) at ruby.h:662
#14 0x080559ad in ruby_exec_internal () at eval.c:1457
#15 0x080559c6 in ruby_exec () at eval.c:1475
#16 0x08055a10 in ruby_run () at eval.c:1492
#17 0x08053a15 in main (argc=0, argv=0x0, envp=0xbffff904) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]