From 8e0dc6fa8db54d43d6d0dc4b81751cc3db06ebf0 Mon Sep 17 00:00:00 2001
From: Tomasz Dąbrowski <t.dabrowski@rock-hard.eu>
Date: Wed, 16 Nov 2016 15:45:47 +0100
Subject: Correct argument specifications for few methods:  - Struct#values_at 
 - Module#define_method  - String#chop  - String#chop!

---
 src/string.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 15fcc502a..8c46da2bf 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2723,8 +2723,8 @@ mrb_init_string(mrb_state *mrb)
   mrb_define_method(mrb, s, "capitalize!",     mrb_str_capitalize_bang, MRB_ARGS_NONE()); /* 15.2.10.5.8  */
   mrb_define_method(mrb, s, "chomp",           mrb_str_chomp,           MRB_ARGS_ANY());  /* 15.2.10.5.9  */
   mrb_define_method(mrb, s, "chomp!",          mrb_str_chomp_bang,      MRB_ARGS_ANY());  /* 15.2.10.5.10 */
-  mrb_define_method(mrb, s, "chop",            mrb_str_chop,            MRB_ARGS_REQ(1)); /* 15.2.10.5.11 */
-  mrb_define_method(mrb, s, "chop!",           mrb_str_chop_bang,       MRB_ARGS_REQ(1)); /* 15.2.10.5.12 */
+  mrb_define_method(mrb, s, "chop",            mrb_str_chop,            MRB_ARGS_NONE()); /* 15.2.10.5.11 */
+  mrb_define_method(mrb, s, "chop!",           mrb_str_chop_bang,       MRB_ARGS_NONE()); /* 15.2.10.5.12 */
   mrb_define_method(mrb, s, "downcase",        mrb_str_downcase,        MRB_ARGS_NONE()); /* 15.2.10.5.13 */
   mrb_define_method(mrb, s, "downcase!",       mrb_str_downcase_bang,   MRB_ARGS_NONE()); /* 15.2.10.5.14 */
   mrb_define_method(mrb, s, "empty?",          mrb_str_empty_p,         MRB_ARGS_NONE()); /* 15.2.10.5.16 */
-- 
cgit v1.2.3


From 57900d809f7dac7f450eadd475ad225a6cca39cb Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Thu, 17 Nov 2016 18:02:10 +0900
Subject: String#include? does not take integers

---
 src/string.c     | 18 ++++--------------
 test/t/string.rb |  2 --
 2 files changed, 4 insertions(+), 16 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 8c46da2bf..f8ab9478f 100644
--- a/src/string.c
+++ b/src/string.c
@@ -1530,22 +1530,12 @@ mrb_str_hash_m(mrb_state *mrb, mrb_value self)
 static mrb_value
 mrb_str_include(mrb_state *mrb, mrb_value self)
 {
-  mrb_int i;
   mrb_value str2;
-  mrb_bool include_p;
-
-  mrb_get_args(mrb, "o", &str2);
-  if (mrb_fixnum_p(str2)) {
-    include_p = (memchr(RSTRING_PTR(self), mrb_fixnum(str2), RSTRING_LEN(self)) != NULL);
-  }
-  else {
-    str2 = mrb_str_to_str(mrb, str2);
-    i = str_index(mrb, self, str2, 0);
-
-    include_p = (i != -1);
-  }
 
-  return mrb_bool_value(include_p);
+  mrb_get_args(mrb, "S", &str2);
+  if (str_index(mrb, self, str2, 0) < 0)
+    return mrb_bool_value(FALSE);
+  return mrb_bool_value(TRUE);
 }
 
 /* 15.2.10.5.22 */
diff --git a/test/t/string.rb b/test/t/string.rb
index fbaada451..e67389b5c 100644
--- a/test/t/string.rb
+++ b/test/t/string.rb
@@ -381,8 +381,6 @@ assert('String#hash', '15.2.10.5.20') do
 end
 
 assert('String#include?', '15.2.10.5.21') do
-  assert_true 'abc'.include?(97)
-  assert_false 'abc'.include?(100)
   assert_true 'abc'.include?('a')
   assert_false 'abc'.include?('d')
 end
-- 
cgit v1.2.3


From 1af9e363f28810e46e263cd13da918cdf779d71d Mon Sep 17 00:00:00 2001
From: Tomasz Dąbrowski <t.dabrowski@rock-hard.eu>
Date: Tue, 22 Nov 2016 13:19:05 +0100
Subject: Fixes for compiling mruby as C++

---
 include/mruby.h                                   | 16 ++++++++++++++++
 include/mruby/boxing_nan.h                        |  2 +-
 mrbgems/mruby-inline-struct/test/inline.c         |  6 +++---
 mrbgems/mruby-objectspace/src/mruby_objectspace.c |  2 +-
 mrbgems/mruby-sprintf/src/sprintf.c               | 12 ++++++------
 src/backtrace.c                                   |  4 ++--
 src/string.c                                      |  2 +-
 7 files changed, 30 insertions(+), 14 deletions(-)

(limited to 'src/string.c')

diff --git a/include/mruby.h b/include/mruby.h
index e6eaf7f27..d40dce6d9 100644
--- a/include/mruby.h
+++ b/include/mruby.h
@@ -28,10 +28,26 @@
 #ifndef MRUBY_H
 #define MRUBY_H
 
+#ifdef __cplusplus
+#define __STDC_LIMIT_MACROS
+#define __STDC_CONSTANT_MACROS
+#define __STDC_FORMAT_MACROS
+#endif
+
 #include <stdint.h>
 #include <stddef.h>
 #include <limits.h>
 
+#ifdef __cplusplus
+#ifndef SIZE_MAX
+#ifdef __SIZE_MAX__
+#define SIZE_MAX __SIZE_MAX__
+#else
+#define SIZE_MAX std::numeric_limits<size_t>::max()
+#endif
+#endif
+#endif
+
 #ifdef MRB_DEBUG
 #include <assert.h>
 #define mrb_assert(p) assert(p)
diff --git a/include/mruby/boxing_nan.h b/include/mruby/boxing_nan.h
index 154150ece..052164ffc 100644
--- a/include/mruby/boxing_nan.h
+++ b/include/mruby/boxing_nan.h
@@ -53,7 +53,7 @@ typedef struct mrb_value {
 #define mrb_float_pool(mrb,f) mrb_float_value(mrb,f)
 
 #define mrb_tt(o)       ((enum mrb_vtype)(((o).value.ttt & 0xfc000)>>14)-1)
-#define mrb_type(o)     ((uint32_t)0xfff00000 < (o).value.ttt ? mrb_tt(o) : MRB_TT_FLOAT)
+#define mrb_type(o)     (enum mrb_vtype)((uint32_t)0xfff00000 < (o).value.ttt ? mrb_tt(o) : MRB_TT_FLOAT)
 #define mrb_ptr(o)      ((void*)((((uintptr_t)0x3fffffffffff)&((uintptr_t)((o).value.p)))<<2))
 #define mrb_float(o)    (o).f
 #define mrb_cptr(o)     mrb_ptr(o)
diff --git a/mrbgems/mruby-inline-struct/test/inline.c b/mrbgems/mruby-inline-struct/test/inline.c
index 49ef31d00..772248e9b 100644
--- a/mrbgems/mruby-inline-struct/test/inline.c
+++ b/mrbgems/mruby-inline-struct/test/inline.c
@@ -6,7 +6,7 @@
 static mrb_value
 istruct_test_initialize(mrb_state *mrb, mrb_value self)
 {
-  char *string = mrb_istruct_ptr(self);
+  char *string = (char*)mrb_istruct_ptr(self);
   mrb_int size = mrb_istruct_size();
   mrb_value object;
   mrb_get_args(mrb, "o", &object);
@@ -31,7 +31,7 @@ istruct_test_initialize(mrb_state *mrb, mrb_value self)
 static mrb_value
 istruct_test_to_s(mrb_state *mrb, mrb_value self)
 {
-  return mrb_str_new_cstr(mrb, mrb_istruct_ptr(self));
+  return mrb_str_new_cstr(mrb, (const char*)mrb_istruct_ptr(self));
 }
 
 static mrb_value
@@ -63,7 +63,7 @@ istruct_test_test_receive_direct(mrb_state *mrb, mrb_value self)
 static mrb_value
 istruct_test_mutate(mrb_state *mrb, mrb_value self)
 {
-  char *ptr = mrb_istruct_ptr(self);
+  char *ptr = (char*)mrb_istruct_ptr(self);
   memcpy(ptr, "mutate", 6);
   return mrb_nil_value();
 }
diff --git a/mrbgems/mruby-objectspace/src/mruby_objectspace.c b/mrbgems/mruby-objectspace/src/mruby_objectspace.c
index d5cd4f5a1..d0a8effd0 100644
--- a/mrbgems/mruby-objectspace/src/mruby_objectspace.c
+++ b/mrbgems/mruby-objectspace/src/mruby_objectspace.c
@@ -49,7 +49,7 @@ static mrb_value
 os_count_objects(mrb_state *mrb, mrb_value self)
 {
   struct os_count_struct obj_count = { 0 };
-  enum mrb_vtype i;
+  mrb_int i;
   mrb_value hash;
 
   if (mrb_get_args(mrb, "|H", &hash) == 0) {
diff --git a/mrbgems/mruby-sprintf/src/sprintf.c b/mrbgems/mruby-sprintf/src/sprintf.c
index ccee23bd2..696d0939f 100644
--- a/mrbgems/mruby-sprintf/src/sprintf.c
+++ b/mrbgems/mruby-sprintf/src/sprintf.c
@@ -844,13 +844,13 @@ retry:
             strncpy(nbuf, RSTRING_PTR(val), sizeof(nbuf));
             break;
           case 8:
-            snprintf(nbuf, sizeof(nbuf), "%"MRB_PRIo, v);
+            snprintf(nbuf, sizeof(nbuf), "%" MRB_PRIo, v);
             break;
           case 10:
-            snprintf(nbuf, sizeof(nbuf), "%"MRB_PRId, v);
+            snprintf(nbuf, sizeof(nbuf), "%" MRB_PRId, v);
             break;
           case 16:
-            snprintf(nbuf, sizeof(nbuf), "%"MRB_PRIx, v);
+            snprintf(nbuf, sizeof(nbuf), "%" MRB_PRIx, v);
             break;
           }
           s = nbuf;
@@ -865,13 +865,13 @@ retry:
             strncpy(++s, RSTRING_PTR(val), sizeof(nbuf)-1);
             break;
           case 8:
-            snprintf(++s, sizeof(nbuf)-1, "%"MRB_PRIo, v);
+            snprintf(++s, sizeof(nbuf)-1, "%" MRB_PRIo, v);
             break;
           case 10:
-            snprintf(++s, sizeof(nbuf)-1, "%"MRB_PRId, v);
+            snprintf(++s, sizeof(nbuf)-1, "%" MRB_PRId, v);
             break;
           case 16:
-            snprintf(++s, sizeof(nbuf)-1, "%"MRB_PRIx, v);
+            snprintf(++s, sizeof(nbuf)-1, "%" MRB_PRIx, v);
             break;
           }
           if (v < 0) {
diff --git a/src/backtrace.c b/src/backtrace.c
index 11082b705..285af562f 100644
--- a/src/backtrace.c
+++ b/src/backtrace.c
@@ -160,7 +160,7 @@ static void
 output_backtrace_i(mrb_state *mrb, struct backtrace_location_raw *loc_raw, void *data)
 {
   struct backtrace_location loc;
-  struct output_backtrace_args *args = data;
+  struct output_backtrace_args *args = (struct output_backtrace_args *)data;
 
   loc.i          = loc_raw->i;
   loc.lineno     = loc_raw->lineno;
@@ -338,7 +338,7 @@ save_backtrace_i(mrb_state *mrb,
     else {
       new_n_allocated = mrb->backtrace.n_allocated * 2;
     }
-    mrb->backtrace.entries =
+    mrb->backtrace.entries = (mrb_backtrace_entry *)
       mrb_realloc(mrb,
                   mrb->backtrace.entries,
                   sizeof(mrb_backtrace_entry) * new_n_allocated);
diff --git a/src/string.c b/src/string.c
index f8ab9478f..5e490bf03 100644
--- a/src/string.c
+++ b/src/string.c
@@ -361,7 +361,7 @@ mrb_memsearch(const void *x0, mrb_int m, const void *y0, mrb_int n)
     return 0;
   }
   else if (m == 1) {
-    const unsigned char *ys = memchr(y, *x, n);
+    const unsigned char *ys = (const unsigned char *)memchr(y, *x, n);
 
     if (ys)
       return ys - y;
-- 
cgit v1.2.3


From 76a1bdfa29469576112a41b78a132b785616a3f9 Mon Sep 17 00:00:00 2001
From: Clayton Smith <clayton.smith@shopify.com>
Date: Wed, 16 Nov 2016 10:10:14 -0500
Subject: Get String length after args in String#chomp!

Fixes RCE issue
Reported by @bouk
---
 src/string.c     |  4 +++-
 test/t/string.rb | 14 +++++++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 5e490bf03..f47294291 100644
--- a/src/string.c
+++ b/src/string.c
@@ -1235,11 +1235,13 @@ mrb_str_chomp_bang(mrb_state *mrb, mrb_value str)
   char *p, *pp;
   mrb_int rslen;
   mrb_int len;
+  mrb_int argc;
   struct RString *s = mrb_str_ptr(str);
 
   mrb_str_modify(mrb, s);
+  argc = mrb_get_args(mrb, "|S", &rs);
   len = RSTR_LEN(s);
-  if (mrb_get_args(mrb, "|S", &rs) == 0) {
+  if (argc == 0) {
     if (len == 0) return mrb_nil_value();
   smart_chomp:
     if (RSTR_PTR(s)[len-1] == '\n') {
diff --git a/test/t/string.rb b/test/t/string.rb
index e67389b5c..80fcbe6fa 100644
--- a/test/t/string.rb
+++ b/test/t/string.rb
@@ -251,6 +251,19 @@ assert('String#chomp!', '15.2.10.5.10') do
   assert_equal 'abc', e
 end
 
+assert('String#chomp! uses the correct length') do
+  class A
+    def to_str
+      $s.replace("AA")
+      "A"
+    end
+  end
+
+  $s = "AAA"
+  $s.chomp!(A.new)
+  assert_equal $s, "A"
+end
+
 assert('String#chop', '15.2.10.5.11') do
   a = ''.chop
   b = 'abc'.chop
@@ -683,4 +696,3 @@ assert('String#freeze') do
 
   assert_raise(RuntimeError) { str.upcase! }
 end
-
-- 
cgit v1.2.3


From a0fbc46ccd3e129532b05a9fe4f13f42a3c349b2 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Sat, 3 Dec 2016 18:47:04 +0900
Subject: Import locale insensitive strtod() from Ruby1.8; fix #3270

The function was renamed to `mrb_float_read(const char*, char**)`.
---
 include/mruby/value.h                 |   5 +-
 mrbgems/mruby-compiler/core/codegen.c |   4 +-
 mrbgems/mruby-compiler/core/parse.y   |   2 +-
 src/string.c                          | 242 +++++++++++++++++++++++++++++++++-
 4 files changed, 245 insertions(+), 8 deletions(-)

(limited to 'src/string.c')

diff --git a/include/mruby/value.h b/include/mruby/value.h
index 61110e3dd..54d197f8f 100644
--- a/include/mruby/value.h
+++ b/include/mruby/value.h
@@ -62,12 +62,12 @@ struct mrb_state;
 # define MRB_PRIx PRIx32
 #endif
 
+
+MRB_API double mrb_float_read(const char*, char**);
 #ifdef MRB_USE_FLOAT
   typedef float mrb_float;
-# define str_to_mrb_float(buf) strtof(buf, NULL)
 #else
   typedef double mrb_float;
-# define str_to_mrb_float(buf) strtod(buf, NULL)
 #endif
 
 #if defined _MSC_VER && _MSC_VER < 1900
@@ -85,7 +85,6 @@ MRB_API int mrb_msvc_snprintf(char *s, size_t n, const char *format, ...);
 #  define isnan _isnan
 #  define isinf(n) (!_finite(n) && !_isnan(n))
 #  define signbit(n) (_copysign(1.0, (n)) < 0.0)
-#  define strtof (float)strtod
 static const unsigned int IEEE754_INFINITY_BITS_SINGLE = 0x7F800000;
 #  define INFINITY (*(float *)&IEEE754_INFINITY_BITS_SINGLE)
 #  define NAN ((float)(INFINITY - INFINITY))
diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index 414ca2627..b2cd12225 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -2211,7 +2211,7 @@ codegen(codegen_scope *s, node *tree, int val)
   case NODE_FLOAT:
     if (val) {
       char *p = (char*)tree;
-      mrb_float f = str_to_mrb_float(p);
+      mrb_float f = mrb_float_read(p, NULL);
       int off = new_lit(s, mrb_float_value(s->mrb, f));
 
       genop(s, MKOP_ABx(OP_LOADL, cursp(), off));
@@ -2227,7 +2227,7 @@ codegen(codegen_scope *s, node *tree, int val)
       case NODE_FLOAT:
         {
           char *p = (char*)tree;
-          mrb_float f = str_to_mrb_float(p);
+          mrb_float f = mrb_float_read(p, NULL);
           int off = new_lit(s, mrb_float_value(s->mrb, -f));
 
           genop(s, MKOP_ABx(OP_LOADL, cursp(), off));
diff --git a/mrbgems/mruby-compiler/core/parse.y b/mrbgems/mruby-compiler/core/parse.y
index e81d191d9..19cb88e5b 100644
--- a/mrbgems/mruby-compiler/core/parse.y
+++ b/mrbgems/mruby-compiler/core/parse.y
@@ -4912,7 +4912,7 @@ parser_yylex(parser_state *p)
       char *endp;
 
       errno = 0;
-      d = strtod(tok(p), &endp);
+      d = mrb_float_read(tok(p), &endp);
       if (d == 0 && endp == tok(p)) {
         yywarning_s(p, "corrupted float value %s", tok(p));
       }
diff --git a/src/string.c b/src/string.c
index f47294291..e3a268f78 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2286,7 +2286,7 @@ mrb_cstr_to_dbl(mrb_state *mrb, const char * p, mrb_bool badcheck)
   if (!badcheck && p[0] == '0' && (p[1] == 'x' || p[1] == 'X')) {
     return 0.0;
   }
-  d = strtod(p, &end);
+  d = mrb_float_read(p, &end);
   if (p == end) {
     if (badcheck) {
 bad:
@@ -2324,7 +2324,7 @@ bad:
       return 0.0;
     }
 
-    d = strtod(p, &end);
+    d = mrb_float_read(p, &end);
     if (badcheck) {
       if (!end || p == end) goto bad;
       while (*end && ISSPACE(*end)) end++;
@@ -2749,3 +2749,241 @@ mrb_init_string(mrb_state *mrb)
 
   mrb_define_method(mrb, s, "freeze",          mrb_str_freeze,          MRB_ARGS_NONE());
 }
+
+/* 
+ *	Source code for the "strtod" library procedure.
+ *
+ * Copyright (c) 1988-1993 The Regents of the University of California.
+ * Copyright (c) 1994 Sun Microsystems, Inc.
+ *
+ * Permission to use, copy, modify, and distribute this
+ * software and its documentation for any purpose and without
+ * fee is hereby granted, provided that the above copyright
+ * notice appear in all copies.  The University of California
+ * makes no representations about the suitability of this
+ * software for any purpose.  It is provided "as is" without
+ * express or implied warranty.
+ *
+ * RCS: @(#) $Id: strtod.c 11708 2007-02-12 23:01:19Z shyouhei $
+ */
+
+#include <ctype.h>
+#include <errno.h>
+extern  int     errno;
+
+#ifndef __STDC__
+# ifdef __GNUC__
+#  define const __const__
+# else
+#  define const
+# endif
+#endif
+
+static const int maxExponent = 511; /* Largest possible base 10 exponent.  Any
+                                     * exponent larger than this will already
+                                     * produce underflow or overflow, so there's
+                                     * no need to worry about additional digits.
+                                     */
+static const double powersOf10[] = {/* Table giving binary powers of 10.  Entry */
+    10.,                            /* is 10^2^i.  Used to convert decimal */
+    100.,			    /* exponents into floating-point numbers. */
+    1.0e4,
+    1.0e8,
+    1.0e16,
+    1.0e32,
+    1.0e64,
+    1.0e128,
+    1.0e256
+};
+
+double
+mrb_float_read(const char *string, char **endPtr)
+/*  const char *string;		   A decimal ASCII floating-point number,
+				 * optionally preceded by white space.
+				 * Must have form "-I.FE-X", where I is the
+				 * integer part of the mantissa, F is the
+				 * fractional part of the mantissa, and X
+				 * is the exponent.  Either of the signs
+				 * may be "+", "-", or omitted.  Either I
+				 * or F may be omitted, or both.  The decimal
+				 * point isn't necessary unless F is present.
+				 * The "E" may actually be an "e".  E and X
+				 * may both be omitted (but not just one).
+				 */
+/*  char **endPtr;		   If non-NULL, store terminating character's
+				 * address here. */
+{
+    int sign, expSign = FALSE;
+    double fraction, dblExp;
+    const double *d;
+    register const char *p;
+    register int c;
+    int exp = 0;		/* Exponent read from "EX" field. */
+    int fracExp = 0;		/* Exponent that derives from the fractional
+				 * part.  Under normal circumstatnces, it is
+				 * the negative of the number of digits in F.
+				 * However, if I is very long, the last digits
+				 * of I get dropped (otherwise a long I with a
+				 * large negative exponent could cause an
+				 * unnecessary overflow on I alone).  In this
+				 * case, fracExp is incremented one for each
+				 * dropped digit. */
+    int mantSize;		/* Number of digits in mantissa. */
+    int decPt;			/* Number of mantissa digits BEFORE decimal
+				 * point. */
+    const char *pExp;		/* Temporarily holds location of exponent
+				 * in string. */
+
+    /*
+     * Strip off leading blanks and check for a sign.
+     */
+
+    p = string;
+    while (isspace(*p)) {
+	p += 1;
+    }
+    if (*p == '-') {
+	sign = TRUE;
+	p += 1;
+    } else {
+	if (*p == '+') {
+	    p += 1;
+	}
+	sign = FALSE;
+    }
+
+    /*
+     * Count the number of digits in the mantissa (including the decimal
+     * point), and also locate the decimal point.
+     */
+
+    decPt = -1;
+    for (mantSize = 0; ; mantSize += 1)
+    {
+	c = *p;
+	if (!isdigit(c)) {
+	    if ((c != '.') || (decPt >= 0)) {
+		break;
+	    }
+	    decPt = mantSize;
+	}
+	p += 1;
+    }
+
+    /*
+     * Now suck up the digits in the mantissa.  Use two integers to
+     * collect 9 digits each (this is faster than using floating-point).
+     * If the mantissa has more than 18 digits, ignore the extras, since
+     * they can't affect the value anyway.
+     */
+    
+    pExp  = p;
+    p -= mantSize;
+    if (decPt < 0) {
+	decPt = mantSize;
+    } else {
+	mantSize -= 1;			/* One of the digits was the point. */
+    }
+    if (mantSize > 18) {
+	fracExp = decPt - 18;
+	mantSize = 18;
+    } else {
+	fracExp = decPt - mantSize;
+    }
+    if (mantSize == 0) {
+	fraction = 0.0;
+	p = string;
+	goto done;
+    } else {
+	int frac1, frac2;
+	frac1 = 0;
+	for ( ; mantSize > 9; mantSize -= 1)
+	{
+	    c = *p;
+	    p += 1;
+	    if (c == '.') {
+		c = *p;
+		p += 1;
+	    }
+	    frac1 = 10*frac1 + (c - '0');
+	}
+	frac2 = 0;
+	for (; mantSize > 0; mantSize -= 1)
+	{
+	    c = *p;
+	    p += 1;
+	    if (c == '.') {
+		c = *p;
+		p += 1;
+	    }
+	    frac2 = 10*frac2 + (c - '0');
+	}
+	fraction = (1.0e9 * frac1) + frac2;
+    }
+
+    /*
+     * Skim off the exponent.
+     */
+
+    p = pExp;
+    if ((*p == 'E') || (*p == 'e')) {
+	p += 1;
+	if (*p == '-') {
+	    expSign = TRUE;
+	    p += 1;
+	} else {
+	    if (*p == '+') {
+		p += 1;
+	    }
+	    expSign = FALSE;
+	}
+	while (isdigit(*p)) {
+	    exp = exp * 10 + (*p - '0');
+	    p += 1;
+	}
+    }
+    if (expSign) {
+	exp = fracExp - exp;
+    } else {
+	exp = fracExp + exp;
+    }
+
+    /*
+     * Generate a floating-point number that represents the exponent.
+     * Do this by processing the exponent one bit at a time to combine
+     * many powers of 2 of 10. Then combine the exponent with the
+     * fraction.
+     */
+    
+    if (exp < 0) {
+	expSign = TRUE;
+	exp = -exp;
+    } else {
+	expSign = FALSE;
+    }
+    if (exp > maxExponent) {
+	exp = maxExponent;
+	errno = ERANGE;
+    }
+    dblExp = 1.0;
+    for (d = powersOf10; exp != 0; exp >>= 1, d += 1) {
+	if (exp & 01) {
+	    dblExp *= *d;
+	}
+    }
+    if (expSign) {
+	fraction /= dblExp;
+    } else {
+	fraction *= dblExp;
+    }
+
+done:
+    if (endPtr != NULL) {
+	*endPtr = (char *) p;
+    }
+
+    if (sign) {
+	return -fraction;
+    }
+    return fraction;
+}
-- 
cgit v1.2.3


From 5c651d6ce94449df8f096b624bc99fd4de3d698e Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Sat, 3 Dec 2016 18:55:52 +0900
Subject: add MRB_API to mrb_float_read(); ref #3270

---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index e3a268f78..4f722b273 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2796,7 +2796,7 @@ static const double powersOf10[] = {/* Table giving binary powers of 10.  Entry
     1.0e256
 };
 
-double
+MRB_API double
 mrb_float_read(const char *string, char **endPtr)
 /*  const char *string;		   A decimal ASCII floating-point number,
 				 * optionally preceded by white space.
-- 
cgit v1.2.3


From 6187c21bd96d120c4e58ebeae83749ab9f56a16c Mon Sep 17 00:00:00 2001
From: Felix Jones <felix.jones@glidecreations.com>
Date: Wed, 7 Dec 2016 12:46:47 +0000
Subject: Wrapped string.c errno with ifndef macro for platforms that use
 inbuilt errno macro

---
 src/string.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 4f722b273..4189d84d0 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2750,7 +2750,7 @@ mrb_init_string(mrb_state *mrb)
   mrb_define_method(mrb, s, "freeze",          mrb_str_freeze,          MRB_ARGS_NONE());
 }
 
-/* 
+/*
  *	Source code for the "strtod" library procedure.
  *
  * Copyright (c) 1988-1993 The Regents of the University of California.
@@ -2769,7 +2769,9 @@ mrb_init_string(mrb_state *mrb)
 
 #include <ctype.h>
 #include <errno.h>
+#ifndef errno
 extern  int     errno;
+#endif
 
 #ifndef __STDC__
 # ifdef __GNUC__
@@ -2876,7 +2878,7 @@ mrb_float_read(const char *string, char **endPtr)
      * If the mantissa has more than 18 digits, ignore the extras, since
      * they can't affect the value anyway.
      */
-    
+
     pExp  = p;
     p -= mantSize;
     if (decPt < 0) {
@@ -2954,7 +2956,7 @@ mrb_float_read(const char *string, char **endPtr)
      * many powers of 2 of 10. Then combine the exponent with the
      * fraction.
      */
-    
+
     if (exp < 0) {
 	expSign = TRUE;
 	exp = -exp;
-- 
cgit v1.2.3


From fe86cf4c916b2ef89abd1ac7cd7eca63b7ae953e Mon Sep 17 00:00:00 2001
From: Felix Jones <felix.jones@glidecreations.com>
Date: Wed, 7 Dec 2016 14:17:09 +0000
Subject: Removed the errno declaration from string.c

---
 src/string.c | 3 ---
 1 file changed, 3 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 4189d84d0..a9351619b 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2769,9 +2769,6 @@ mrb_init_string(mrb_state *mrb)
 
 #include <ctype.h>
 #include <errno.h>
-#ifndef errno
-extern  int     errno;
-#endif
 
 #ifndef __STDC__
 # ifdef __GNUC__
-- 
cgit v1.2.3


From c27dbfedf4dbd95ef17c6ad2b84933088e56d2cd Mon Sep 17 00:00:00 2001
From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Date: Thu, 8 Dec 2016 15:56:50 +0900
Subject: disable define const on VS

---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index a9351619b..c921ca56d 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2773,7 +2773,7 @@ mrb_init_string(mrb_state *mrb)
 #ifndef __STDC__
 # ifdef __GNUC__
 #  define const __const__
-# else
+# elif !defined(_MSC_VER)
 #  define const
 # endif
 #endif
-- 
cgit v1.2.3


From 2827655b9cf3099ef323cfb7967e5ddaa8ba28e1 Mon Sep 17 00:00:00 2001
From: Felix Jones <felix.jones@glidecreations.com>
Date: Thu, 8 Dec 2016 12:38:00 +0000
Subject: Removed unnecessary const macro - const keyword is already a
 dependency

---
 src/string.c | 8 --------
 1 file changed, 8 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index c921ca56d..a4f8085ec 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2770,14 +2770,6 @@ mrb_init_string(mrb_state *mrb)
 #include <ctype.h>
 #include <errno.h>
 
-#ifndef __STDC__
-# ifdef __GNUC__
-#  define const __const__
-# elif !defined(_MSC_VER)
-#  define const
-# endif
-#endif
-
 static const int maxExponent = 511; /* Largest possible base 10 exponent.  Any
                                      * exponent larger than this will already
                                      * produce underflow or overflow, so there's
-- 
cgit v1.2.3


From 10bb7ad693e7c7443de924a39c1fedb4461108ba Mon Sep 17 00:00:00 2001
From: Takashi Kokubun <takashikkbn@gmail.com>
Date: Sun, 11 Dec 2016 01:45:38 +0900
Subject: Implement Object#freeze

---
 include/mruby/class.h  |  1 +
 include/mruby/object.h |  4 ++++
 include/mruby/string.h |  5 -----
 src/array.c            |  4 ++++
 src/hash.c             |  7 +++++--
 src/kernel.c           | 10 ++++++++++
 src/string.c           | 15 ++-------------
 test/t/array.rb        |  7 +++++++
 test/t/hash.rb         |  7 +++++++
 test/t/kernel.rb       |  5 +++++
 10 files changed, 45 insertions(+), 20 deletions(-)

(limited to 'src/string.c')

diff --git a/include/mruby/class.h b/include/mruby/class.h
index 246e82e59..ce953af3b 100644
--- a/include/mruby/class.h
+++ b/include/mruby/class.h
@@ -52,6 +52,7 @@ mrb_class(mrb_state *mrb, mrb_value v)
 }
 
 // TODO: figure out where to put user flags
+#define MRB_FLAG_IS_FROZEN (1 << 18)
 #define MRB_FLAG_IS_PREPENDED (1 << 19)
 #define MRB_FLAG_IS_ORIGIN (1 << 20)
 #define MRB_CLASS_ORIGIN(c) do {\
diff --git a/include/mruby/object.h b/include/mruby/object.h
index 9fbfe34f3..da44027e1 100644
--- a/include/mruby/object.h
+++ b/include/mruby/object.h
@@ -22,6 +22,10 @@ struct RBasic {
 };
 #define mrb_basic_ptr(v) ((struct RBasic*)(mrb_ptr(v)))
 
+#define RBASIC_FROZEN_P(o) ((o)->flags & MRB_FLAG_IS_FROZEN)
+#define RBASIC_SET_FROZEN_FLAG(o) ((o)->flags |= MRB_FLAG_IS_FROZEN)
+#define RBASIC_UNSET_FROZEN_FLAG(o) ((o)->flags &= ~MRB_FLAG_IS_FROZEN)
+
 struct RObject {
   MRB_OBJECT_HEADER;
   struct iv_tbl *iv;
diff --git a/include/mruby/string.h b/include/mruby/string.h
index b30c1ed98..9ccf8f187 100644
--- a/include/mruby/string.h
+++ b/include/mruby/string.h
@@ -62,10 +62,6 @@ struct RString {
 #define RSTR_SET_NOFREE_FLAG(s) ((s)->flags |= MRB_STR_NOFREE)
 #define RSTR_UNSET_NOFREE_FLAG(s) ((s)->flags &= ~MRB_STR_NOFREE)
 
-#define RSTR_FROZEN_P(s) ((s)->flags & MRB_STR_FROZEN)
-#define RSTR_SET_FROZEN_FLAG(s) ((s)->flags |= MRB_STR_FROZEN)
-#define RSTR_UNSET_FROZEN_FLAG(s) ((s)->flags &= ~MRB_STR_FROZEN)
-
 /*
  * Returns a pointer from a Ruby string
  */
@@ -80,7 +76,6 @@ MRB_API mrb_int mrb_str_strlen(mrb_state*, struct RString*);
 
 #define MRB_STR_SHARED    1
 #define MRB_STR_NOFREE    2
-#define MRB_STR_FROZEN    4
 #define MRB_STR_NO_UTF    8
 #define MRB_STR_EMBED    16
 #define MRB_STR_EMBED_LEN_MASK 0x3e0
diff --git a/src/array.c b/src/array.c
index f6599bd5b..c6bac7b47 100644
--- a/src/array.c
+++ b/src/array.c
@@ -108,6 +108,10 @@ ary_fill_with_nil(mrb_value *ptr, mrb_int size)
 static void
 ary_modify(mrb_state *mrb, struct RArray *a)
 {
+  if (RBASIC_FROZEN_P(a)) {
+    mrb_raise(mrb, E_RUNTIME_ERROR, "can't modify frozen array");
+  }
+
   if (ARY_SHARED_P(a)) {
     mrb_shared_array *shared = a->aux.shared;
 
diff --git a/src/hash.c b/src/hash.c
index 93fe656e0..d0e865b5c 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -98,9 +98,9 @@ static void mrb_hash_modify(mrb_state *mrb, mrb_value hash);
 static inline mrb_value
 mrb_hash_ht_key(mrb_state *mrb, mrb_value key)
 {
-  if (mrb_string_p(key) && !RSTR_FROZEN_P(mrb_str_ptr(key))) {
+  if (mrb_string_p(key) && !RBASIC_FROZEN_P(mrb_str_ptr(key))) {
     key = mrb_str_dup(mrb, key);
-    RSTR_SET_FROZEN_FLAG(mrb_str_ptr(key));
+    RBASIC_SET_FROZEN_FLAG(mrb_str_ptr(key));
   }
   return key;
 }
@@ -278,6 +278,9 @@ mrb_hash_tbl(mrb_state *mrb, mrb_value hash)
 static void
 mrb_hash_modify(mrb_state *mrb, mrb_value hash)
 {
+  if (RBASIC_FROZEN_P(mrb_hash_ptr(hash))) {
+    mrb_raise(mrb, E_RUNTIME_ERROR, "can't modify frozen hash");
+  }
   mrb_hash_tbl(mrb, hash);
 }
 
diff --git a/src/kernel.c b/src/kernel.c
index c63e05596..78e57a17a 100644
--- a/src/kernel.c
+++ b/src/kernel.c
@@ -450,6 +450,15 @@ mrb_obj_extend_m(mrb_state *mrb, mrb_value self)
   return mrb_obj_extend(mrb, argc, argv, self);
 }
 
+static mrb_value
+mrb_obj_freeze(mrb_state *mrb, mrb_value self)
+{
+  struct RBasic *b = mrb_basic_ptr(self);
+
+  RBASIC_SET_FROZEN_FLAG(b);
+  return self;
+}
+
 /* 15.3.1.3.15 */
 /*
  *  call-seq:
@@ -1124,6 +1133,7 @@ mrb_init_kernel(mrb_state *mrb)
   mrb_define_method(mrb, krn, "eql?",                       mrb_obj_equal_m,                 MRB_ARGS_REQ(1));    /* 15.3.1.3.10 */
   mrb_define_method(mrb, krn, "equal?",                     mrb_obj_equal_m,                 MRB_ARGS_REQ(1));    /* 15.3.1.3.11 */
   mrb_define_method(mrb, krn, "extend",                     mrb_obj_extend_m,                MRB_ARGS_ANY());     /* 15.3.1.3.13 */
+  mrb_define_method(mrb, krn, "freeze",                     mrb_obj_freeze,                  MRB_ARGS_NONE());
   mrb_define_method(mrb, krn, "global_variables",           mrb_f_global_variables,          MRB_ARGS_NONE());    /* 15.3.1.3.14 */
   mrb_define_method(mrb, krn, "hash",                       mrb_obj_hash,                    MRB_ARGS_NONE());    /* 15.3.1.3.15 */
   mrb_define_method(mrb, krn, "initialize_copy",            mrb_obj_init_copy,               MRB_ARGS_REQ(1));    /* 15.3.1.3.16 */
diff --git a/src/string.c b/src/string.c
index a4f8085ec..7234ecf2b 100644
--- a/src/string.c
+++ b/src/string.c
@@ -501,7 +501,7 @@ str_index(mrb_state *mrb, mrb_value str, mrb_value sub, mrb_int offset)
 static void
 check_frozen(mrb_state *mrb, struct RString *s)
 {
-  if (RSTR_FROZEN_P(s)) {
+  if (RBASIC_FROZEN_P(s)) {
     mrb_raise(mrb, E_RUNTIME_ERROR, "can't modify frozen string");
   }
 }
@@ -700,15 +700,6 @@ mrb_str_modify(mrb_state *mrb, struct RString *s)
   }
 }
 
-static mrb_value
-mrb_str_freeze(mrb_state *mrb, mrb_value str)
-{
-  struct RString *s = mrb_str_ptr(str);
-
-  RSTR_SET_FROZEN_FLAG(s);
-  return str;
-}
-
 MRB_API mrb_value
 mrb_str_resize(mrb_state *mrb, mrb_value str, mrb_int len)
 {
@@ -2217,7 +2208,7 @@ mrb_string_value_cstr(mrb_state *mrb, mrb_value *ptr)
   char *p = RSTR_PTR(ps);
 
   if (!p || p[len] != '\0') {
-    if (RSTR_FROZEN_P(ps)) {
+    if (RBASIC_FROZEN_P(ps)) {
       *ptr = str = mrb_str_dup(mrb, str);
       ps = mrb_str_ptr(str);
     }
@@ -2746,8 +2737,6 @@ mrb_init_string(mrb_state *mrb)
   mrb_define_method(mrb, s, "upcase!",         mrb_str_upcase_bang,     MRB_ARGS_NONE()); /* 15.2.10.5.43 */
   mrb_define_method(mrb, s, "inspect",         mrb_str_inspect,         MRB_ARGS_NONE()); /* 15.2.10.5.46(x) */
   mrb_define_method(mrb, s, "bytes",           mrb_str_bytes,           MRB_ARGS_NONE());
-
-  mrb_define_method(mrb, s, "freeze",          mrb_str_freeze,          MRB_ARGS_NONE());
 }
 
 /*
diff --git a/test/t/array.rb b/test/t/array.rb
index 9cc2f64ad..cf7ed4704 100644
--- a/test/t/array.rb
+++ b/test/t/array.rb
@@ -373,3 +373,10 @@ assert("Array#rindex") do
   $a = [2, 3, 4, 5, 6, 7, 8, 9, 10, Sneaky.new]
   assert_equal 0, $a.rindex(1)
 end
+
+assert('Array#freeze') do
+  a = [].freeze
+  assert_raise(RuntimeError) do
+    a[0] = 1
+  end
+end
diff --git a/test/t/hash.rb b/test/t/hash.rb
index f076db8e5..c63b8c009 100644
--- a/test/t/hash.rb
+++ b/test/t/hash.rb
@@ -366,3 +366,10 @@ assert('Hash#rehash') do
   h.rehash
   assert_equal("b", h[[:b]])
 end
+
+assert('Hash#freeze') do
+  h = {}.freeze
+  assert_raise(RuntimeError) do
+    h[:a] = 'b'
+  end
+end
diff --git a/test/t/kernel.rb b/test/t/kernel.rb
index e59bd6a10..42abed9df 100644
--- a/test/t/kernel.rb
+++ b/test/t/kernel.rb
@@ -257,6 +257,11 @@ assert('Kernel#extend works on toplevel', '15.3.1.3.13') do
   assert_true respond_to?(:test_method)
 end
 
+assert('Kernel#freeze') do
+  obj = Object.new
+  assert_equal obj, obj.freeze
+end
+
 assert('Kernel#global_variables', '15.3.1.3.14') do
   assert_equal Array, global_variables.class
 end
-- 
cgit v1.2.3


From 92c843dd07211d698a6dac90fbd740e483ae34af Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Mon, 12 Dec 2016 00:54:36 +0900
Subject: rename prefix RBASIC_ to MRB_; ref #3340

---
 include/mruby/object.h | 6 +++---
 src/array.c            | 2 +-
 src/hash.c             | 6 +++---
 src/kernel.c           | 2 +-
 src/string.c           | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

(limited to 'src/string.c')

diff --git a/include/mruby/object.h b/include/mruby/object.h
index da44027e1..9347981d4 100644
--- a/include/mruby/object.h
+++ b/include/mruby/object.h
@@ -22,9 +22,9 @@ struct RBasic {
 };
 #define mrb_basic_ptr(v) ((struct RBasic*)(mrb_ptr(v)))
 
-#define RBASIC_FROZEN_P(o) ((o)->flags & MRB_FLAG_IS_FROZEN)
-#define RBASIC_SET_FROZEN_FLAG(o) ((o)->flags |= MRB_FLAG_IS_FROZEN)
-#define RBASIC_UNSET_FROZEN_FLAG(o) ((o)->flags &= ~MRB_FLAG_IS_FROZEN)
+#define MRB_FROZEN_P(o) ((o)->flags & MRB_FLAG_IS_FROZEN)
+#define MRB_SET_FROZEN_FLAG(o) ((o)->flags |= MRB_FLAG_IS_FROZEN)
+#define MRB_UNSET_FROZEN_FLAG(o) ((o)->flags &= ~MRB_FLAG_IS_FROZEN)
 
 struct RObject {
   MRB_OBJECT_HEADER;
diff --git a/src/array.c b/src/array.c
index c6bac7b47..7601e9c17 100644
--- a/src/array.c
+++ b/src/array.c
@@ -108,7 +108,7 @@ ary_fill_with_nil(mrb_value *ptr, mrb_int size)
 static void
 ary_modify(mrb_state *mrb, struct RArray *a)
 {
-  if (RBASIC_FROZEN_P(a)) {
+  if (MRB_FROZEN_P(a)) {
     mrb_raise(mrb, E_RUNTIME_ERROR, "can't modify frozen array");
   }
 
diff --git a/src/hash.c b/src/hash.c
index d0e865b5c..c65c8926e 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -98,9 +98,9 @@ static void mrb_hash_modify(mrb_state *mrb, mrb_value hash);
 static inline mrb_value
 mrb_hash_ht_key(mrb_state *mrb, mrb_value key)
 {
-  if (mrb_string_p(key) && !RBASIC_FROZEN_P(mrb_str_ptr(key))) {
+  if (mrb_string_p(key) && !MRB_FROZEN_P(mrb_str_ptr(key))) {
     key = mrb_str_dup(mrb, key);
-    RBASIC_SET_FROZEN_FLAG(mrb_str_ptr(key));
+    MRB_SET_FROZEN_FLAG(mrb_str_ptr(key));
   }
   return key;
 }
@@ -278,7 +278,7 @@ mrb_hash_tbl(mrb_state *mrb, mrb_value hash)
 static void
 mrb_hash_modify(mrb_state *mrb, mrb_value hash)
 {
-  if (RBASIC_FROZEN_P(mrb_hash_ptr(hash))) {
+  if (MRB_FROZEN_P(mrb_hash_ptr(hash))) {
     mrb_raise(mrb, E_RUNTIME_ERROR, "can't modify frozen hash");
   }
   mrb_hash_tbl(mrb, hash);
diff --git a/src/kernel.c b/src/kernel.c
index 78e57a17a..a5166deb2 100644
--- a/src/kernel.c
+++ b/src/kernel.c
@@ -455,7 +455,7 @@ mrb_obj_freeze(mrb_state *mrb, mrb_value self)
 {
   struct RBasic *b = mrb_basic_ptr(self);
 
-  RBASIC_SET_FROZEN_FLAG(b);
+  MRB_SET_FROZEN_FLAG(b);
   return self;
 }
 
diff --git a/src/string.c b/src/string.c
index 7234ecf2b..ee5aa04f3 100644
--- a/src/string.c
+++ b/src/string.c
@@ -501,7 +501,7 @@ str_index(mrb_state *mrb, mrb_value str, mrb_value sub, mrb_int offset)
 static void
 check_frozen(mrb_state *mrb, struct RString *s)
 {
-  if (RBASIC_FROZEN_P(s)) {
+  if (MRB_FROZEN_P(s)) {
     mrb_raise(mrb, E_RUNTIME_ERROR, "can't modify frozen string");
   }
 }
@@ -2208,7 +2208,7 @@ mrb_string_value_cstr(mrb_state *mrb, mrb_value *ptr)
   char *p = RSTR_PTR(ps);
 
   if (!p || p[len] != '\0') {
-    if (RBASIC_FROZEN_P(ps)) {
+    if (MRB_FROZEN_P(ps)) {
       *ptr = str = mrb_str_dup(mrb, str);
       ps = mrb_str_ptr(str);
     }
-- 
cgit v1.2.3


From 3a7c3695360e598ce4279a979cc9138a35971615 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Tue, 13 Dec 2016 10:48:36 +0900
Subject: Make sure str->capa is under MRB_INT_MAX; fix #3342

---
 src/string.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index ee5aa04f3..dfe4fa3b1 100644
--- a/src/string.c
+++ b/src/string.c
@@ -156,14 +156,14 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
   else
     capa = s->as.heap.aux.capa;
 
-  if (RSTR_LEN(s) >= MRB_INT_MAX - (mrb_int)len) {
+  total = RSTR_LEN(s)+len;
+  if (total >= MRB_INT_MAX) {
     mrb_raise(mrb, E_ARGUMENT_ERROR, "string size too big");
   }
-  total = RSTR_LEN(s)+len;
   if (capa <= total) {
     while (total > capa) {
       if (capa + 1 >= MRB_INT_MAX / 2) {
-        capa = (total + 4095) / 4096;
+        capa = MRB_INT_MAX;
         break;
       }
       capa = (capa + 1) * 2;
-- 
cgit v1.2.3


From 3bedd22d55fafef83f2ddf387cb595cf5ea60e63 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Tue, 13 Dec 2016 10:50:04 +0900
Subject: Add assertion to make sure new capacity does not overflow.

---
 src/string.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index dfe4fa3b1..0049fdd5b 100644
--- a/src/string.c
+++ b/src/string.c
@@ -118,8 +118,8 @@ mrb_str_buf_new(mrb_state *mrb, size_t capa)
   return mrb_obj_value(s);
 }
 
-static inline void
-resize_capa(mrb_state *mrb, struct RString *s, mrb_int capacity)
+static void
+resize_capa(mrb_state *mrb, struct RString *s, size_t capacity)
 {
   if (RSTR_EMBED_P(s)) {
     if (RSTRING_EMBED_LEN_MAX < capacity) {
@@ -133,6 +133,9 @@ resize_capa(mrb_state *mrb, struct RString *s, mrb_int capacity)
     }
   }
   else {
+#if SIZE_MAX > MRB_INT_MAX
+    mrb_assert(capacity <= MRB_INT_MAX);
+#endif
     s->as.heap.ptr = (char *)mrb_realloc(mrb, RSTR_PTR(s), capacity+1);
     s->as.heap.aux.capa = capacity;
   }
-- 
cgit v1.2.3


From 868d2e528fce86f380a2d099877f6cb8ffd1ff69 Mon Sep 17 00:00:00 2001
From: Clayton Smith <clayton.smith@shopify.com>
Date: Thu, 15 Dec 2016 09:36:22 -0500
Subject: Fix crash when exponent is -2147483648

---
 src/string.c     | 9 ++++++++-
 test/t/string.rb | 4 ++++
 2 files changed, 12 insertions(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 0049fdd5b..ce27cdaa1 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2868,7 +2868,11 @@ mrb_float_read(const char *string, char **endPtr)
 	mantSize -= 1;			/* One of the digits was the point. */
     }
     if (mantSize > 18) {
-	fracExp = decPt - 18;
+	if (decPt - 18 > 29999) {
+	    fracExp = 29999;
+	} else {
+	    fracExp = decPt - 18;
+	}
 	mantSize = 18;
     } else {
 	fracExp = decPt - mantSize;
@@ -2922,6 +2926,9 @@ mrb_float_read(const char *string, char **endPtr)
 	}
 	while (isdigit(*p)) {
 	    exp = exp * 10 + (*p - '0');
+	    if (exp > 19999) {
+		exp = 19999;
+	    }
 	    p += 1;
 	}
     }
diff --git a/test/t/string.rb b/test/t/string.rb
index 80fcbe6fa..20dc49d92 100644
--- a/test/t/string.rb
+++ b/test/t/string.rb
@@ -596,10 +596,14 @@ assert('String#to_f', '15.2.10.5.38') do
   a = ''.to_f
   b = '123456789'.to_f
   c = '12345.6789'.to_f
+  d = '1e-2147483648'.to_f
+  e = '1e2147483648'.to_f
 
   assert_float(0.0, a)
   assert_float(123456789.0, b)
   assert_float(12345.6789, c)
+  assert_float(0, d)
+  assert_float(Float::INFINITY, e)
 end
 
 assert('String#to_i', '15.2.10.5.39') do
-- 
cgit v1.2.3


From 0de65a88d44c108ec5035be2741bed486ad88de5 Mon Sep 17 00:00:00 2001
From: ksss <co000ri@gmail.com>
Date: Fri, 23 Dec 2016 23:13:23 +0900
Subject: Do nothing when empty string

Fix #3361
---
 src/string.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index ce27cdaa1..a177aafba 100644
--- a/src/string.c
+++ b/src/string.c
@@ -754,6 +754,9 @@ mrb_str_concat(mrb_state *mrb, mrb_value self, mrb_value other)
     other = mrb_str_to_str(mrb, other);
   }
   s2 = mrb_str_ptr(other);
+  if (RSTR_LEN(s2) == 0) {
+    return;
+  }
   len = RSTR_LEN(s1) + RSTR_LEN(s2);
 
   if (RSTRING_CAPA(self) < len) {
-- 
cgit v1.2.3


From c626b823cabf8ee7acbdf57e44597de3974c5f17 Mon Sep 17 00:00:00 2001
From: ksss <co000ri@gmail.com>
Date: Fri, 23 Dec 2016 23:30:35 +0900
Subject: Check overflow string length

Fix #3360
---
 src/string.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index ce27cdaa1..2d5006612 100644
--- a/src/string.c
+++ b/src/string.c
@@ -756,6 +756,9 @@ mrb_str_concat(mrb_state *mrb, mrb_value self, mrb_value other)
   s2 = mrb_str_ptr(other);
   len = RSTR_LEN(s1) + RSTR_LEN(s2);
 
+  if (len < 0 || len >= MRB_INT_MAX) {
+    mrb_raise(mrb, E_ARGUMENT_ERROR, "string size too big");
+  }
   if (RSTRING_CAPA(self) < len) {
     resize_capa(mrb, s1, len);
   }
-- 
cgit v1.2.3


From 342b1de65c5f044e1f3dc08b6e04c9cd0206abc3 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Sat, 31 Dec 2016 23:31:45 +0900
Subject: str_buf_cat(): should allocate at least  RSTRING_EMBED_LEN_MAX+1.

---
 src/string.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 56eeef3a2..d41237f44 100644
--- a/src/string.c
+++ b/src/string.c
@@ -158,6 +158,8 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
     capa = RSTRING_EMBED_LEN_MAX;
   else
     capa = s->as.heap.aux.capa;
+  if (capa <= RSTRING_EMBED_LEN_MAX)
+    capa = RSTRING_EMBED_LEN_MAX+1;
 
   total = RSTR_LEN(s)+len;
   if (total >= MRB_INT_MAX) {
-- 
cgit v1.2.3


From 1ed4de58d016a25d8a6ae4576e447dab1709535c Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Sat, 31 Dec 2016 23:33:34 +0900
Subject: str_buf_cat(): better size check added; ref #3342

---
 src/string.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index d41237f44..072bf2226 100644
--- a/src/string.c
+++ b/src/string.c
@@ -163,15 +163,20 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
 
   total = RSTR_LEN(s)+len;
   if (total >= MRB_INT_MAX) {
+  size_error:
     mrb_raise(mrb, E_ARGUMENT_ERROR, "string size too big");
   }
   if (capa <= total) {
     while (total > capa) {
-      if (capa + 1 >= MRB_INT_MAX / 2) {
-        capa = MRB_INT_MAX;
-        break;
+      if (capa <= MRB_INT_MAX / 2) {
+        capa *= 2;
+      }
+      else {
+        goto size_error;
       }
-      capa = (capa + 1) * 2;
+    }
+    if (capa < total || capa > MRB_INT_MAX) {
+      goto size_error;
     }
     resize_capa(mrb, s, capa);
   }
-- 
cgit v1.2.3


From 30b6648b9c53f8c3f5156910758cb37eb0d654a7 Mon Sep 17 00:00:00 2001
From: ksss <co000ri@gmail.com>
Date: Mon, 2 Jan 2017 16:33:58 +0900
Subject: Small refactoring: should use RSTR_CAPA

---
 src/string.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 072bf2226..b57f1cec4 100644
--- a/src/string.c
+++ b/src/string.c
@@ -154,10 +154,7 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
       off = ptr - RSTR_PTR(s);
   }
 
-  if (RSTR_EMBED_P(s))
-    capa = RSTRING_EMBED_LEN_MAX;
-  else
-    capa = s->as.heap.aux.capa;
+  capa = RSTR_CAPA(s);
   if (capa <= RSTRING_EMBED_LEN_MAX)
     capa = RSTRING_EMBED_LEN_MAX+1;
 
-- 
cgit v1.2.3


From 8a9a24152a23595fba0802f555d49e0c263836af Mon Sep 17 00:00:00 2001
From: ksss <co000ri@gmail.com>
Date: Mon, 2 Jan 2017 16:54:34 +0900
Subject: Fix memory error on str_buf_cat

Modify from nofree to embed string
---
 src/string.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index b57f1cec4..ae2e5ccc8 100644
--- a/src/string.c
+++ b/src/string.c
@@ -695,14 +695,21 @@ mrb_str_modify(mrb_state *mrb, struct RString *s)
   }
   if (RSTR_NOFREE_P(s)) {
     char *p = s->as.heap.ptr;
+    mrb_int len = s->as.heap.len;
 
-    s->as.heap.ptr = (char *)mrb_malloc(mrb, (size_t)s->as.heap.len+1);
+    RSTR_UNSET_NOFREE_FLAG(s);
+    if (len < RSTRING_EMBED_LEN_MAX) {
+      RSTR_SET_EMBED_FLAG(s);
+      RSTR_SET_EMBED_LEN(s, len);
+    }
+    else {
+      s->as.heap.ptr = (char *)mrb_malloc(mrb, (size_t)len+1);
+      s->as.heap.aux.capa = len;
+    }
     if (p) {
-      memcpy(RSTR_PTR(s), p, s->as.heap.len);
+      memcpy(RSTR_PTR(s), p, len);
     }
-    RSTR_PTR(s)[s->as.heap.len] = '\0';
-    s->as.heap.aux.capa = s->as.heap.len;
-    RSTR_UNSET_NOFREE_FLAG(s);
+    RSTR_PTR(s)[len] = '\0';
     return;
   }
 }
-- 
cgit v1.2.3


From f53f73f30ca390d27994e9092ff9b6b18aa615bf Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Fri, 6 Jan 2017 14:25:01 +0900
Subject: Should not deallocate shared string referring static; fix #3373

---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index ae2e5ccc8..d011f60ca 100644
--- a/src/string.c
+++ b/src/string.c
@@ -669,7 +669,7 @@ mrb_str_modify(mrb_state *mrb, struct RString *s)
   if (RSTR_SHARED_P(s)) {
     mrb_shared_string *shared = s->as.heap.aux.shared;
 
-    if (shared->refcnt == 1 && s->as.heap.ptr == shared->ptr) {
+    if (shared->nofree == 0 && shared->refcnt == 1 && s->as.heap.ptr == shared->ptr) {
       s->as.heap.ptr = shared->ptr;
       s->as.heap.aux.capa = shared->len;
       RSTR_PTR(s)[s->as.heap.len] = '\0';
-- 
cgit v1.2.3


From 9a76a0bd809e06089e6a09aa72e01ccf82806056 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Fri, 6 Jan 2017 14:51:21 +0900
Subject: Move mrb_assert() position.

---
 src/string.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index d011f60ca..5aaef5826 100644
--- a/src/string.c
+++ b/src/string.c
@@ -121,6 +121,9 @@ mrb_str_buf_new(mrb_state *mrb, size_t capa)
 static void
 resize_capa(mrb_state *mrb, struct RString *s, size_t capacity)
 {
+#if SIZE_MAX > MRB_INT_MAX
+    mrb_assert(capacity < MRB_INT_MAX);
+#endif
   if (RSTR_EMBED_P(s)) {
     if (RSTRING_EMBED_LEN_MAX < capacity) {
       char *const tmp = (char *)mrb_malloc(mrb, capacity+1);
@@ -133,9 +136,6 @@ resize_capa(mrb_state *mrb, struct RString *s, size_t capacity)
     }
   }
   else {
-#if SIZE_MAX > MRB_INT_MAX
-    mrb_assert(capacity <= MRB_INT_MAX);
-#endif
     s->as.heap.ptr = (char *)mrb_realloc(mrb, RSTR_PTR(s), capacity+1);
     s->as.heap.aux.capa = capacity;
   }
-- 
cgit v1.2.3


From c6a11725923090278bb4941579751650d9aaebce Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Fri, 6 Jan 2017 14:52:04 +0900
Subject: Add pointer cast to pacify warnings.

---
 src/string.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 5aaef5826..976c34687 100644
--- a/src/string.c
+++ b/src/string.c
@@ -132,12 +132,12 @@ resize_capa(mrb_state *mrb, struct RString *s, size_t capacity)
       RSTR_UNSET_EMBED_FLAG(s);
       s->as.heap.ptr = tmp;
       s->as.heap.len = len;
-      s->as.heap.aux.capa = capacity;
+      s->as.heap.aux.capa = (mrb_int)capacity;
     }
   }
   else {
-    s->as.heap.ptr = (char *)mrb_realloc(mrb, RSTR_PTR(s), capacity+1);
-    s->as.heap.aux.capa = capacity;
+    s->as.heap.ptr = (char*)mrb_realloc(mrb, RSTR_PTR(s), capacity+1);
+    s->as.heap.aux.capa = (mrb_int)capacity;
   }
 }
 
-- 
cgit v1.2.3


From 885d929398cf6962f3b0d292cf44105976f6c848 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Fri, 6 Jan 2017 14:53:00 +0900
Subject: Improve capacity enhancing conditions

---
 src/array.c  | 4 ++--
 src/string.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'src/string.c')

diff --git a/src/array.c b/src/array.c
index 54ff26721..420907866 100644
--- a/src/array.c
+++ b/src/array.c
@@ -182,10 +182,10 @@ ary_expand_capa(mrb_state *mrb, struct RArray *a, size_t len)
       capa *= 2;
     }
     else {
-      goto size_error;
+      capa = len;
     }
   }
-  if (capa < len || capa > MRB_INT_MAX) {
+  if (capa < len || capa > ARY_MAX_SIZE) {
     goto size_error;
   }
 
diff --git a/src/string.c b/src/string.c
index 976c34687..b4746545a 100644
--- a/src/string.c
+++ b/src/string.c
@@ -169,7 +169,7 @@ str_buf_cat(mrb_state *mrb, struct RString *s, const char *ptr, size_t len)
         capa *= 2;
       }
       else {
-        goto size_error;
+        capa = total;
       }
     }
     if (capa < total || capa > MRB_INT_MAX) {
-- 
cgit v1.2.3


From e1ff71029f95e3274136263adbdc51c662ec52de Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Wed, 11 Jan 2017 17:51:11 +0900
Subject: String#replace should check replacing string; fix #3374

This issue was reported by https://hackerone.com/tunz
---
 src/string.c | 1 +
 1 file changed, 1 insertion(+)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index b4746545a..d6bdd6975 100644
--- a/src/string.c
+++ b/src/string.c
@@ -519,6 +519,7 @@ str_replace(mrb_state *mrb, struct RString *s1, struct RString *s2)
   long len;
 
   check_frozen(mrb, s1);
+  if (s1 == s2) return mrb_obj_value(s1);
   len = RSTR_LEN(s2);
   if (RSTR_SHARED_P(s1)) {
     str_decref(mrb, s1->as.heap.aux.shared);
-- 
cgit v1.2.3


From 708088c5fafd469d04a1b428fc49b8b7c27607d2 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Mon, 23 Jan 2017 10:52:40 +0900
Subject: Should not make empty strings shared; fix #3407

---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index d6bdd6975..02c7ce426 100644
--- a/src/string.c
+++ b/src/string.c
@@ -423,7 +423,7 @@ byte_subseq(mrb_state *mrb, mrb_value str, mrb_int beg, mrb_int len)
   mrb_shared_string *shared;
 
   orig = mrb_str_ptr(str);
-  if (RSTR_EMBED_P(orig)) {
+  if (RSTR_EMBED_P(orig) || RSTR_LEN(orig) == 0) {
     s = str_new(mrb, orig->as.ary+beg, len);
   }
   else {
-- 
cgit v1.2.3


From 5e1d923381072ebcbe002d70bc198a6e95c31f50 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Mon, 23 Jan 2017 14:35:26 +0900
Subject: Changed the behavior of mrb_range_beg_len(); close #3411

The new API is:

int mrb_range_beg_len(mrb, range, &beg, &len, len, trunc)

The new argument `trunc` is a boolean value that specifies
whether the function truncates the range. The new return value
is an integer instead of a boolean, that is:

 0: not a range
 1: range with proper edges
 2: out of range

To get the old behavior, you have to rewrite:

  mrb_range_beg_len(mrb, range, &beg, &len, len)

to:

  mrn_range_beg_len(mrb, range, &beg, &len, len, TRUE) == 1

[Breaking Change]
---
 include/mruby/range.h                 |  2 +-
 mrbgems/mruby-kernel-ext/src/kernel.c |  2 +-
 mrbgems/mruby-string-ext/src/string.c |  8 +++++++-
 src/array.c                           | 19 ++++++++-----------
 src/range.c                           | 20 +++++++-------------
 src/string.c                          | 27 +++++++++++++++------------
 6 files changed, 39 insertions(+), 39 deletions(-)

(limited to 'src/string.c')

diff --git a/include/mruby/range.h b/include/mruby/range.h
index fb602b3f3..41e4f1254 100644
--- a/include/mruby/range.h
+++ b/include/mruby/range.h
@@ -41,7 +41,7 @@ MRB_API struct RRange* mrb_range_ptr(mrb_state *mrb, mrb_value v);
  */
 MRB_API mrb_value mrb_range_new(mrb_state *mrb, mrb_value start, mrb_value end, mrb_bool exclude);
 
-MRB_API mrb_bool mrb_range_beg_len(mrb_state *mrb, mrb_value range, mrb_int *begp, mrb_int *lenp, mrb_int len);
+MRB_API int mrb_range_beg_len(mrb_state *mrb, mrb_value range, mrb_int *begp, mrb_int *lenp, mrb_int len, mrb_bool trunc);
 mrb_value mrb_get_values_at(mrb_state *mrb, mrb_value obj, mrb_int olen, mrb_int argc, const mrb_value *argv, mrb_value (*func)(mrb_state*, mrb_value, mrb_int));
 
 MRB_END_DECL
diff --git a/mrbgems/mruby-kernel-ext/src/kernel.c b/mrbgems/mruby-kernel-ext/src/kernel.c
index 1aa40260e..7bb4dea68 100644
--- a/mrbgems/mruby-kernel-ext/src/kernel.c
+++ b/mrbgems/mruby-kernel-ext/src/kernel.c
@@ -22,7 +22,7 @@ mrb_f_caller(mrb_state *mrb, mrb_value self)
     case 1:
       if (mrb_type(v) == MRB_TT_RANGE) {
         mrb_int beg, len;
-        if (mrb_range_beg_len(mrb, v, &beg, &len, bt_len)) {
+        if (mrb_range_beg_len(mrb, v, &beg, &len, bt_len, TRUE) == 1) {
           lev = beg;
           n = len;
         }
diff --git a/mrbgems/mruby-string-ext/src/string.c b/mrbgems/mruby-string-ext/src/string.c
index c6a9e1d0b..7e87b3db4 100644
--- a/mrbgems/mruby-string-ext/src/string.c
+++ b/mrbgems/mruby-string-ext/src/string.c
@@ -56,8 +56,14 @@ mrb_str_byteslice(mrb_state *mrb, mrb_value str)
       mrb_int beg;
 
       len = RSTRING_LEN(str);
-      if (mrb_range_beg_len(mrb, a1, &beg, &len, len)) {
+      switch (mrb_range_beg_len(mrb, a1, &beg, &len, len, TRUE)) {
+      case 0:                   /* not range */
+        break;
+      case 1:                   /* range */
         return mrb_str_substr(mrb, str, beg, len);
+      case 2:                   /* out of range */
+        mrb_raisef(mrb, E_RANGE_ERROR, "%S out of range", a1);
+        break;
       }
       return mrb_nil_value();
     }
diff --git a/src/array.c b/src/array.c
index f9155d173..e41183d68 100644
--- a/src/array.c
+++ b/src/array.c
@@ -742,7 +742,7 @@ mrb_ary_aget(mrb_state *mrb, mrb_value self)
     switch (mrb_type(index)) {
       /* a[n..m] */
     case MRB_TT_RANGE:
-      if (mrb_range_beg_len(mrb, index, &i, &len, a->len)) {
+      if (mrb_range_beg_len(mrb, index, &i, &len, a->len, TRUE) == 1) {
         return ary_subseq(mrb, a, i, len);
       }
       else {
@@ -808,19 +808,16 @@ mrb_ary_aset(mrb_state *mrb, mrb_value self)
 
   mrb_ary_modify(mrb, mrb_ary_ptr(self));
   if (mrb_get_args(mrb, "oo|o", &v1, &v2, &v3) == 2) {
-    switch (mrb_type(v1)) {
     /* a[n..m] = v */
-    case MRB_TT_RANGE:
-      if (mrb_range_beg_len(mrb, v1, &i, &len, RARRAY_LEN(self))) {
-        mrb_ary_splice(mrb, self, i, len, v2);
-      }
+    switch (mrb_range_beg_len(mrb, v1, &i, &len, RARRAY_LEN(self), FALSE)) {
+    case 0:                   /* not range */
+      mrb_ary_set(mrb, self, aget_index(mrb, v1), v2);
       break;
-    /* a[n] = v */
-    case MRB_TT_FIXNUM:
-      mrb_ary_set(mrb, self, mrb_fixnum(v1), v2);
+    case 1:                   /* range */
+      mrb_ary_splice(mrb, self, i, len, v2);
       break;
-    default:
-      mrb_ary_set(mrb, self, aget_index(mrb, v1), v2);
+    case 2:                   /* out of range */
+      mrb_raisef(mrb, E_RANGE_ERROR, "%S out of range", v1);
       break;
     }
     return v2;
diff --git a/src/range.c b/src/range.c
index 73fe7589b..800e64611 100644
--- a/src/range.c
+++ b/src/range.c
@@ -248,13 +248,13 @@ mrb_range_include(mrb_state *mrb, mrb_value range)
   return mrb_bool_value(include_p);
 }
 
-static mrb_bool
-range_beg_len(mrb_state *mrb, mrb_value range, mrb_int *begp, mrb_int *lenp, mrb_int len, mrb_bool trunc)
+int
+mrb_range_beg_len(mrb_state *mrb, mrb_value range, mrb_int *begp, mrb_int *lenp, mrb_int len, mrb_bool trunc)
 {
   mrb_int beg, end;
   struct RRange *r;
 
-  if (mrb_type(range) != MRB_TT_RANGE) return FALSE;
+  if (mrb_type(range) != MRB_TT_RANGE) return 0;
   r = mrb_range_ptr(mrb, range);
 
   beg = mrb_int(mrb, r->edges->beg);
@@ -262,11 +262,11 @@ range_beg_len(mrb_state *mrb, mrb_value range, mrb_int *begp, mrb_int *lenp, mrb
 
   if (beg < 0) {
     beg += len;
-    if (beg < 0) return FALSE;
+    if (beg < 0) return 2;
   }
 
   if (trunc) {
-    if (beg > len) return FALSE;
+    if (beg > len) return 2;
     if (end > len) end = len;
   }
 
@@ -278,13 +278,7 @@ range_beg_len(mrb_state *mrb, mrb_value range, mrb_int *begp, mrb_int *lenp, mrb
 
   *begp = beg;
   *lenp = len;
-  return TRUE;
-}
-
-MRB_API mrb_bool
-mrb_range_beg_len(mrb_state *mrb, mrb_value range, mrb_int *begp, mrb_int *lenp, mrb_int len)
-{
-  return range_beg_len(mrb, range, begp, lenp, len, TRUE);
+  return 1;
 }
 
 /* 15.2.14.4.12(x) */
@@ -405,7 +399,7 @@ mrb_get_values_at(mrb_state *mrb, mrb_value obj, mrb_int olen, mrb_int argc, con
     if (mrb_fixnum_p(argv[i])) {
       mrb_ary_push(mrb, result, func(mrb, obj, mrb_fixnum(argv[i])));
     }
-    else if (range_beg_len(mrb, argv[i], &beg, &len, olen, FALSE)) {
+    else if (mrb_range_beg_len(mrb, argv[i], &beg, &len, olen, FALSE) == 1) {
       mrb_int const end = olen < beg + len ? olen : beg + len;
       for (j = beg; j < end; ++j) {
         mrb_ary_push(mrb, result, func(mrb, obj, j));
diff --git a/src/string.c b/src/string.c
index 02c7ce426..7a75bb63e 100644
--- a/src/string.c
+++ b/src/string.c
@@ -1091,22 +1091,25 @@ num_index:
       return mrb_nil_value();
 
     case MRB_TT_RANGE:
-      /* check if indx is Range */
-      {
-        mrb_int beg, len;
+      goto range_arg;
 
-        len = RSTRING_CHAR_LEN(str);
-        if (mrb_range_beg_len(mrb, indx, &beg, &len, len)) {
-          return str_subseq(mrb, str, beg, len);
-        }
-        else {
-          return mrb_nil_value();
-        }
-      }
-    case MRB_TT_FLOAT:
     default:
       indx = mrb_Integer(mrb, indx);
       if (mrb_nil_p(indx)) {
+      range_arg:
+        {
+          mrb_int beg, len;
+
+          len = RSTRING_CHAR_LEN(str);
+          switch (mrb_range_beg_len(mrb, indx, &beg, &len, len, TRUE)) {
+          case 1:
+            return str_subseq(mrb, str, beg, len);
+          case 2:
+            return mrb_nil_value();
+          default:
+            break;
+          }
+        }
         mrb_raise(mrb, E_TYPE_ERROR, "can't convert to Fixnum");
       }
       idx = mrb_fixnum(indx);
-- 
cgit v1.2.3


From 46e4e342f4a1bf216c027838e343919556703547 Mon Sep 17 00:00:00 2001
From: Edgar Boda-Majer <edgar.boda@gmail.com>
Date: Tue, 7 Feb 2017 13:33:53 +0100
Subject: Fix interpolation escaping in String.inspect

---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 7a75bb63e..c370e0723 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2644,7 +2644,7 @@ mrb_str_inspect(mrb_state *mrb, mrb_value str)
     }
 #endif
     c = *p;
-    if (c == '"'|| c == '\\' || (c == '#' && IS_EVSTR(p, pend))) {
+    if (c == '"'|| c == '\\' || (c == '#' && IS_EVSTR(p+1, pend))) {
       buf[0] = '\\'; buf[1] = c;
       mrb_str_cat(mrb, result, buf, 2);
       continue;
-- 
cgit v1.2.3


From d1bc7caecaf337976351934d5910726106601bd9 Mon Sep 17 00:00:00 2001
From: Tomasz Dabrowski <t.dabrowski@rock-hard.eu>
Date: Fri, 10 Feb 2017 15:17:42 +0100
Subject: Optimization for String#* for 1-byte strings

---
 src/string.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index c370e0723..2e8ebda32 100644
--- a/src/string.c
+++ b/src/string.c
@@ -870,7 +870,9 @@ mrb_str_times(mrb_state *mrb, mrb_value self)
   str2 = str_new(mrb, 0, len);
   str_with_class(mrb, str2, self);
   p = RSTR_PTR(str2);
-  if (len > 0) {
+  if (len == 1) {
+    memset(p, RSTRING_PTR(self)[0], len);
+  } else if (len > 0) {
     n = RSTRING_LEN(self);
     memcpy(p, RSTRING_PTR(self), n);
     while (n <= len/2) {
-- 
cgit v1.2.3


From 6cb7aef56318a345fd7dd9afa3c25e33eb7dd03e Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Sat, 11 Feb 2017 16:00:26 +0900
Subject: Add type cast to pacify warning

---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 2e8ebda32..5e37abee1 100644
--- a/src/string.c
+++ b/src/string.c
@@ -1773,7 +1773,7 @@ mrb_str_reverse_bang(mrb_state *mrb, mrb_value str)
 
     mrb_str_modify(mrb, mrb_str_ptr(str));
     len = RSTRING_LEN(str);
-    buf = mrb_malloc(mrb, (size_t)len);
+    buf = (char*)mrb_malloc(mrb, (size_t)len);
     p = buf;
     e = buf + len;
 
-- 
cgit v1.2.3


From 8f4a929e1a01c8d6176fb53a9ef5dff6de632959 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Sat, 11 Feb 2017 16:27:07 +0900
Subject: String#replace should update s->flags for MRB_STR_NO_UTF.

Otherwise String#size may return wrong length; fix #3448
---
 src/string.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index 5e37abee1..abe8ad865 100644
--- a/src/string.c
+++ b/src/string.c
@@ -519,6 +519,8 @@ str_replace(mrb_state *mrb, struct RString *s1, struct RString *s2)
   long len;
 
   check_frozen(mrb, s1);
+  s1->flags &= ~MRB_STR_NO_UTF;
+  s1->flags |= s2->flags&MRB_STR_NO_UTF;
   if (s1 == s2) return mrb_obj_value(s1);
   len = RSTR_LEN(s2);
   if (RSTR_SHARED_P(s1)) {
-- 
cgit v1.2.3


From 90f262f6426ca2b8c588d0e7083c1a4c97fccee9 Mon Sep 17 00:00:00 2001
From: Tomasz Dabrowski <t.dabrowski@rock-hard.eu>
Date: Sat, 11 Feb 2017 13:02:48 +0100
Subject: Revert "Optimization for String#* for 1-byte strings"

This reverts commit d1bc7caecaf337976351934d5910726106601bd9.
---
 src/string.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index abe8ad865..acf32167d 100644
--- a/src/string.c
+++ b/src/string.c
@@ -872,9 +872,7 @@ mrb_str_times(mrb_state *mrb, mrb_value self)
   str2 = str_new(mrb, 0, len);
   str_with_class(mrb, str2, self);
   p = RSTR_PTR(str2);
-  if (len == 1) {
-    memset(p, RSTRING_PTR(self)[0], len);
-  } else if (len > 0) {
+  if (len > 0) {
     n = RSTRING_LEN(self);
     memcpy(p, RSTRING_PTR(self), n);
     while (n <= len/2) {
-- 
cgit v1.2.3