From 2667d1b38f39390d9c3bb90c5257ffb9723e1c77 Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Fri, 10 Jun 2016 05:48:38 +0000
Subject: [PATCH] hash.c: ensure NUL-terminated for ENV

* hash.c (get_env_cstr): ensure NUL-terminated.
  [ruby-dev:49655] [Bug #12475]
* string.c (rb_str_fill_terminator): return the pointer to the
  NUL-terminated content.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55345 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog             |  8 ++++++++
 hash.c                |  2 +-
 internal.h            |  2 +-
 string.c              |  4 ++--
 test/ruby/test_env.rb | 14 ++++++++++++++
 5 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 98bdc744b5..e5a3f039bf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Fri Jun 10 14:48:36 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* hash.c (get_env_cstr): ensure NUL-terminated.
+	  [ruby-dev:49655] [Bug #12475]
+
+	* string.c (rb_str_fill_terminator): return the pointer to the
+	  NUL-terminated content.
+
 Thu Jun  9 21:42:00 2016  Kazuki Yamaguchi  <k@rhe.jp>
 
 	* ext/openssl/ossl_asn1.c (asn1integer_to_num): Use
diff --git a/hash.c b/hash.c
index 503ff174ac..561aa90400 100644
--- a/hash.c
+++ b/hash.c
@@ -2971,7 +2971,7 @@ get_env_cstr(
     if (memchr(var, '\0', RSTRING_LEN(str))) {
 	rb_raise(rb_eArgError, "bad environment variable %s: contains null byte", name);
     }
-    return var;
+    return rb_str_fill_terminator(str, 1); /* ASCII compatible */
 }
 
 #ifdef _WIN32
diff --git a/internal.h b/internal.h
index 1294b8d091..dc35d31bbd 100644
--- a/internal.h
+++ b/internal.h
@@ -1350,7 +1350,7 @@ VALUE rb_str_quote_unprintable(VALUE);
 VALUE rb_id_quote_unprintable(ID);
 #define QUOTE(str) rb_str_quote_unprintable(str)
 #define QUOTE_ID(id) rb_id_quote_unprintable(id)
-void rb_str_fill_terminator(VALUE str, const int termlen);
+char *rb_str_fill_terminator(VALUE str, const int termlen);
 VALUE rb_str_locktmp_ensure(VALUE str, VALUE (*func)(VALUE), VALUE arg);
 #ifdef RUBY_ENCODING_H
 VALUE rb_external_str_with_enc(VALUE str, rb_encoding *eenc);
diff --git a/string.c b/string.c
index 776a4d32ae..09afe05cb1 100644
--- a/string.c
+++ b/string.c
@@ -2048,12 +2048,12 @@ rb_string_value_cstr(volatile VALUE *ptr)
     return s;
 }
 
-void
+char *
 rb_str_fill_terminator(VALUE str, const int newminlen)
 {
     char *s = RSTRING_PTR(str);
     long len = RSTRING_LEN(str);
-    str_fill_term(str, s, len, newminlen);
+    return str_fill_term(str, s, len, newminlen);
 }
 
 VALUE
diff --git a/test/ruby/test_env.rb b/test/ruby/test_env.rb
index b14ea22996..17323ccf95 100644
--- a/test/ruby/test_env.rb
+++ b/test/ruby/test_env.rb
@@ -455,6 +455,20 @@ class TestEnv < Test::Unit::TestCase
     end
   end
 
+  def test_shared_substring
+    bug12475 = '[ruby-dev:49655] [Bug #12475]'
+    n = [*"0".."9"].join("")*3
+    e0 = ENV[n0 = "E#{n}"]
+    e1 = ENV[n1 = "E#{n}."]
+    ENV[n0] = nil
+    ENV[n1] = nil
+    ENV[n1.chop] = "T#{n}.".chop
+    ENV[n0], e0 = e0, ENV[n0]
+    ENV[n1], e1 = e1, ENV[n1]
+    assert_equal("T#{n}", e0, bug12475)
+    assert_nil(e1, bug12475)
+  end
+
   if RUBY_PLATFORM =~ /bccwin|mswin|mingw/
     def test_memory_leak_aset
       bug9977 = '[ruby-dev:48323] [Bug #9977]'