diff --git a/ChangeLog b/ChangeLog
index 0cd5e555af..a31a61218f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sat Feb 25 16:18:24 2012  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* complex.c (nucomp_marshal_load): raise error on invalid data.
+	  reported by John Firebaugh [ruby-core:42860] [Bug #6076]
+
 Sat Feb 25 14:46:54 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* ext/dl/dl.c (Init_dl): support intrinsic types, size_t, ptrdiff_t
diff --git a/complex.c b/complex.c
index 7f2d79b6d2..b1dfa3a101 100644
--- a/complex.c
+++ b/complex.c
@@ -1260,6 +1260,8 @@ nucomp_marshal_load(VALUE self, VALUE a)
 {
     get_dat1(self);
     Check_Type(a, T_ARRAY);
+    if (RARRAY_LEN(a) != 2)
+	rb_raise(rb_eArgError, "marshaled complex must have an array whose length is 2 but %ld", RARRAY_LEN(a));
     dat->real = RARRAY_PTR(a)[0];
     dat->imag = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);
diff --git a/rational.c b/rational.c
index 3af98c76c5..8d0e8306f5 100644
--- a/rational.c
+++ b/rational.c
@@ -1606,6 +1606,8 @@ nurat_marshal_load(VALUE self, VALUE a)
 {
     get_dat1(self);
     Check_Type(a, T_ARRAY);
+    if (RARRAY_LEN(a) != 2)
+	rb_raise(rb_eArgError, "marshaled rational must have an array whose length is 2 but %ld", RARRAY_LEN(a));
     dat->num = RARRAY_PTR(a)[0];
     dat->den = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);
diff --git a/test/ruby/test_marshal.rb b/test/ruby/test_marshal.rb
index 4b72e371bf..15951bff36 100644
--- a/test/ruby/test_marshal.rb
+++ b/test/ruby/test_marshal.rb
@@ -469,4 +469,18 @@ class TestMarshal < Test::Unit::TestCase
     assert_equal(o1.class, o2.class)
     assert_equal(o1.foo, o2.foo)
   end
+
+  def test_marshal_complex
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\x05")}
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\x06i\x00")}
+    assert_equal(Complex(1, 2), Marshal.load("\x04\bU:\fComplex[\ai\x06i\a"))
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\fComplex[\bi\x00i\x00i\x00")}
+  end
+
+  def test_marshal_rational
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\x05")}
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\x06i\x00")}
+    assert_equal(Rational(1, 2), Marshal.load("\x04\bU:\rRational[\ai\x06i\a"))
+    assert_raise(ArgumentError){Marshal.load("\x04\bU:\rRational[\bi\x00i\x00i\x00")}
+  end
 end