Issue #6076 has been reported by John Firebaugh.

----------------------------------------
Bug #6076: lack of bounds checking in nu{rat,comp}_marshal_load
https://bugs.ruby-lang.org/issues/6076

Author: John Firebaugh
Status: Open
Priority: Normal
Assignee: 
Category: 
Target version: 
ruby -v: ruby 1.9.3p0 (2011-10-30 revision 33570) [x86_64-darwin10.8.0]


nurat_marshal_load and and nucomp_marshal_load access array indicies 0
and 1 without checking that the array is at least size 2 or using
rb_ary_entry. This could be a problem for inputs such as:

    Marshal.load("\x04\bU:\fComplex[\x05")
    Marshal.load("\x04\bU:\fComplex[\x06i\x00")



-- 
http://bugs.ruby-lang.org/