< :前の番号
^ :番号順リスト
> :次の番号
P :前の記事（スレッド移動）
N :次の記事（スレッド移動）
|<:前のスレッド
>|:次のスレッド
^ :返事先
_:自分への返事
>:同じ返事先を持つ記事（前）
<:同じ返事先を持つ記事（後）
---:分割してスレッド表示、再表示
| :分割して（縦）スレッド表示、再表示
~ :スレッドのフレーム消去
.:インデックス
..:インデックスのインデックス
Issue #11192 has been updated by Tomoyuki Chikanaga.
Backport changed from 2.0.0: WONTFIX, 2.1: DONE, 2.2: REQUIRED to 2.0.0: WONTFIX, 2.1: DONE, 2.2: DONE
Backported into `ruby_2_2` branch at r51132.
----------------------------------------
Bug #11192: capture group special variable with large index invokes UB
https://bugs.ruby-lang.org/issues/11192#change-53265
* Author: cremno phobia
* Status: Closed
* Priority: Normal
* Assignee:
* ruby -v:
* Backport: 2.0.0: WONTFIX, 2.1: DONE, 2.2: DONE
----------------------------------------
~~~
$ ruby --dump=parsetree -e "$9999999999"
###########################################################
## Do NOT use this node dump for any purpose other than ##
## debug and research. Compatibility is not guaranteed. ##
###########################################################
# @ NODE_SCOPE (line: 1)
# +- nd_tbl: (empty)
# +- nd_args:
# | (null node)
# +- nd_body:
# @ NODE_NTH_REF (line: 1)
# +- nd_nth: $1410065407
~~~
The culprit is [this line](https://github.com/ruby/ruby/blob/4d059bf9f5f10f3d3088de49fc87e5555db7770d/parse.y#L7673) in `parse.y` which contains a call to `atoi()`.
A simple, non-intrusive fix could be calling a function with well-defined behavior when the resulting value can't be represented instead (such as `strtoul()`) and of course also adding a range check. But perhaps a syntax error is undesired here.
--
https://bugs.ruby-lang.org/