* test/net/http/test_https.rb: Stop the error due to openssl 1.1.1h
On some environments that uses OpenSSL 1.1.1h, the two tests now fail.
http://rubyci.s3.amazonaws.com/android29-x86_64/ruby-master/log/20200924T062352Z.fail.html.gzhttps://github.com/ruby/ruby/runs/1159288773?check_suite_focus=true
```
1) Failure:
TestNetHTTPS#test_get [/data/data/com.termux/files/home/cb/tmp/build/202 00924T062352Z/ruby/test/net/http/test_https.rb:47]:
<"0\x82\x03\xED0\x82\x02\xD5\xA0\x03..."> expected but was
<"0\x82\x03\xE30\x82\x02\xCB\xA0\x03...">.
```
Not sure why, but verify_callback now seems to receive only SERVER_CERT
but not CA_CERT.
It would be good to investigate the issue furthermore, but tentatively,
I want to stop the failures.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67887 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ruby/psych] Fixing compatibility with libyaml 0.2.5
The main issue is that commas aren't allowed in local tags. libyaml
was updated to follow the spec, and our tests were out of date.
See: https://github.com/yaml/libyaml/issues/196https://github.com/ruby/psych/commit/3f5e520fd3
Note that this is not security fix, but need for release processs.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67885 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Use osuosl instead of GitHub releases
Because the package provided by GitHub releases is different from sourceware.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67881 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* ext/socket/init.c: do not return uninitialized buffer
Resize string buffer only if some data is received in
BasicSocket#read_nonblock and some methods.
Co-Authored-By: Samuel Williams <samuel.williams@oriontransfer.co.nz>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67877 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Make RbConfig::CONFIG values mutable [Bug #16738]
As `RbConfig.expand` modifies the argument and involved `CONFIG`
values, its values should be mutable.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67872 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix FrozenError on `Ripper.slice`
Currently `Ripper.slice` raises a FrozenError
```ruby
require 'ripper'
p Ripper.slice('foo', 'ident')
```
```
/path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:193:in `concat': can't modify frozen String (FrozenError)
from /path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:193:in `block in compile'
from /path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:190:in `scan'
from /path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:190:in `compile'
from /path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:169:in `initialize'
from /path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:151:in `new'
from /path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:151:in `token_match'
from /path/to/g/lib/ruby/2.6.0/ripper/lexer.rb:144:in `slice'
from /tmp/tmp.kb4cnhvum2/test.rb:2:in `<main>'
```
This patch will fix the problem.
[Fix GH-1837]
From: Masataka Pocke Kuwabara <kuwabara@pocke.me>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67871 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Do not make disabled directories at installation [Bug #12392]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67870 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
backport 80b5a0ff2a7709367178f29d4ebe1c54122b1c27 partially as a
securify fix for CVE-2020-10663. The patch was provided by Jeremy Evans.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67856 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67869 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fixed duplicated warning
As `command_rhs` is always a "value expression", `command_asgn`
does not need the same check.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67868 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Do not turn on keyword_init for Struct subclass if keyword hash is
empty
This was accidentally turned on because there was no checking for
Qundef.
Also, since only a single keyword is currently supported, simplify
the rb_get_kwargs call.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67866 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
`Regexp` in `MatchData` can be `nil`
`String#sub` with a string pattern defers creating a `Regexp`
until `MatchData#regexp` creates a `Regexp` from the matched
string. `Regexp#last_match(group_name)` accessed its content
without creating the `Regexp` though. [Bug #16508]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67865 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
time.c (find_time_t): fix round-to-zero bug
`find_time_t` did not work correctly for year older than the Epoch
because it used C's integer division (which rounds negative to zero).
For example, `TIme.new(1933)` returned a wrong time whose year is 1922
in Asia/Kuala_Lumpur because there is no 00:00:00 1st Jan. 1933 in the
time zone.
```
$ TZ=Asia/Kuala_Lumpur ruby -e 'p Time.new(1933)'
1932-12-31 00:00:00 +0700
```
This change fixes the issue by using `DIV` macro instead of `/`.
Now `Time.new(1933)` returns a time in 1933.
```
$ TZ=Asia/Kuala_Lumpur ruby -e 'p Time.new(1933)'
1933-01-01 00:20:00 +0720
```
[Bug #16159]
Added a test for [Bug #16159]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67864 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Guard static variable first
* ext/openssl/ossl_asn1.c (Init_ossl_asn1): register the static
variable to grab an internal object, before creating the object.
otherwise the just-created object could get collected during the
global variable list allocation. [Bug #16196]
Slimed down test runtime by stressing openssl.so only [Bug #16196]
Prefer rb_gc_register_mark_object
* ext/openssl/ossl_asn1.c (Init_ossl_asn1): prefer
`rb_gc_register_mark_object`, which is better for constant
objects, over `rb_gc_register_address` for global/static
variables which can be re-assigned at runtime. [Bug #16196]
Skip very time consuming test [Bug #16196]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67863 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
marshal.c: check instance variable count
* marshal.c (w_obj_each): ensure that no instance variable was
added while dumping other instance variables. [Bug #15968]
Hoisted out w_ivar_each
marshal.c: check instance variable count
* marshal.c (w_ivar_each): ensure that no instance variable was
removed while dumping other instance variables. [Bug #15968]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67861 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
atime may not updated unless strictatime is set on macOS Catalina
Cited from mount(8):
```
strictatime
Always update the file access time when reading from a
file. Without this option the filesystem may default to a
less strict update mode, where some access time updates
are skipped for performance reasons. This option could be
ignored if it is not supported by the filesystem.
```
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67827 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
`FileTest.send(command, ...)` allows to call not only FileTest-related
methods but also any method that belongs to Kernel, Object, etc.
patched by <mame@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67814 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
WEBrick: prevent response splitting and header injection
This is a follow up to d9d4a28.
The commit prevented CRLR, but did not address an isolated CR or an
isolated LF.
Co-Authored-By: NARUSE, Yui <naruse@airemix.jp>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67813 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Loop with String#scan without creating substrings
Create the substrings necessary parts only, instead of cutting the
rest of the buffer. Also removed a useless, probable typo, regexp.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67811 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix for wrong fnmatch patttern
* dir.c (file_s_fnmatch): ensure that pattern does not contain a
NUL character. https://hackerone.com/reports/449617
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67809 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
handle_interrupt to defend monitor state [Bug #15992]
If an exception is raised from another thread for example Timeout
and this thread is just after `mon_exit`'s `@mon_owner = nil`,
the exception breaks the state of MonitorMixin. To prevent that situation,
it need to block interruption in mon_enter and mon_exit.
Avoid creating Hash objects per each mon_synchronize call (#2393)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67774 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fixed heap-use-after-free
* string.c (rb_str_sub_bang): retrieves a pointer to the
replacement string buffer just before using it, for the case of
replacement with the receiver string itself. [Bug #16105]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67773 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
UTF LE is fixed at least the first 2 bytes
* io.c (io_strip_bom): if the first 2 bytes are 0xFF0xFE, it
should be a little-endian UTF, 16 or 32. [Bug #16099]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67772 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Get rid of undefined behavior
* string.c (rb_str_sub_bang): str and repl can be same.
[Bug #15946]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67770 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Preserve the string content at self-copying
* string.c (rb_str_init): preserve the embedded content when
self-copying with a capacity. [Bug #15937]
New buffer for shared string
* string.c (rb_str_init): allocate new buffer if the string is
shared. [Bug #15937]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67769 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Update the certificate files to make the test pass on Debian 10
The old certificate files (for example, test/rubygems/ca_cert.pem) were
signed by SHA1. This message digest is considered too weak and rejected
by OpenSSL 1.1.1 or later. Because of this, the test suite does not
pass on Debian 10.
https://rubyci.org/logs/rubyci.s3.amazonaws.com/debian/ruby-master/log/20190527T123003Z.fail.html.gz#test%2Frubygems
This change regenerates the files.
A shell script for the regeneration (util/create_certs.sh) is also
added.
* remove trailing spaces.
Removed inconsistency file from upstream repository of rubygems.
followed up ae2a904ce9bffedee7d110dc60fd51c0a2879a5b
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67768 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
String#b: Don't depend on dependent string
Registering a string that depend on a dependent string as fstring
can lead to use-after-free. See c06ddfe and 3f95620 for details.
The following script triggers use-after-free on trunk, 2.4.6, 2.5.5
and 2.6.3. Credits to @wanabe for using eval as a cross-version way
of registering a fstring.
```ruby
a = ('j' * 24).b.b
eval('', binding, a)
p a
4.times { GC.start }
p a
```
- string.c (str_replace_shared_without_enc): when given a
dependent string, depend on the root of the dependent
string.
[Bug #15934]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67767 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Get rid of indirect sharing
* string.c (str_duplicate): share the root shared string if the
original string is already sharing, so that all shared strings
refer the root shared string directly. indirect sharing can
cause a dangling pointer.
[Bug #15792]
str_duplicate: Don't share with a frozen shared string
This is a follow up for 3f9562015e651735bfc2fdd14e8f6963b673e22a.
Before this commit, it was possible to create a shared string which
shares with another shared string by passing a frozen shared string
to `str_duplicate`.
Such string looks like:
```
-------- -----------------
| root | ------ owns -----> | root's buffer |
-------- -----------------
^ ^ ^
----------- | |
| shared1 | ------ references ----- |
----------- |
^ |
----------- |
| shared2 | ------ references ---------
-----------
```
This is bad news because `rb_fstring(shared2)` can make `shared1`
independent, which severs the reference from `shared1` to `root`:
```c
/* from fstr_update_callback() */
str = str_new_frozen(rb_cString, shared2); /* can return shared1 */
if (STR_SHARED_P(str)) { /* shared1 is also a shared string */
str_make_independent(str); /* no frozen check */
}
```
If `shared1` was the only reference to `root`, then `root` can be
reclaimed by the GC, leaving `shared2` in a corrupted state:
```
----------- --------------------
| shared1 | -------- owns --------> | shared1's buffer |
----------- --------------------
^
|
----------- -------------------------
| shared2 | ------ references ----> | root's buffer (freed) |
----------- -------------------------
```
Here is a reproduction script for the situation this commit fixes.
```ruby
a = ('a' * 24).strip.freeze.strip
-a
p a
4.times { GC.start }
p a
```
- string.c (str_duplicate): always share with the root string when
the original is a shared string.
- test_rb_str_dup.rb: specifically test `rb_str_dup` to make
sure it does not try to share with a shared string.
[Bug #15792]
Closes: https://github.com/ruby/ruby/pull/2159
Update dependencies
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67766 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix SystemStackError when calling a method in an unused refinement
Fixes [Bug #15720]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67765 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
parse.y: function parser_mixed_error & parser_mixed_escape
Fix mixed encoding in heredoc
Heredocs are parsed line-by-line, so we need to keep track of the
temporary encoding of the string. Previously, a heredoc would
only detect mixed encoding errors if they were on the same line,
this changes things so they will be caught on different lines.
Fixes [Bug #15839]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67763 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
