Default page

Edit File: ChangeLog

Thu Jun 27 20:55:23 2013  URABE Shyouhei  <shyouhei@ruby-lang.org>

* test/openssl/test_ssl.rb: Oops, sorry!

Thu Jun 27 20:21:18 2013  URABE Shyouhei  <shyouhei@ruby-lang.org>

* ext/openssl/lib/openssl/ssl-internal.rb (OpenSSL::SSL#verify_certificate_identity):
	  fix hostname verification. Patch by nahi.

* test/openssl/test_ssl.rb (OpenSSL#test_verify_certificate_identity):
	  test for above.

Sat May 18 23:34:50 2013  Kouhei Sutou  <kou@cozmixng.org>

* lib/rexml/document.rb: move entity_expansion_text_limit accessor to ...
	* lib/rexml/rexml.rb: ... here to make rexml/text independent from
	  REXML::Document. It causes circular require.
	* lib/rexml/document.rb (REXML::Document.entity_expansion_text_limit):
	  deprecated.
	* lib/rexml/document.rb (REXML::Document.entity_expansion_text_limit=):
	  deprecated.
	* lib/rexml/text.rb: add missing require "rexml/rexml" for
	  REXML.entity_expansion_text_limit.
	  Reported by Robert Ulejczyk. Thanks!!! [ruby-core:52895] [Bug #7961]

Sat May 18 23:34:50 2013  Aaron Patterson <aaron@tenderlovemaking.com>

* lib/rexml/document.rb (REXML::Document.entity_expansion_text_limit):
	  new attribute to read/write entity expansion text limit.  the default
	  limit is 10Kb.

* lib/rexml/text.rb (REXML::Text.unnormalize): check above attribute.

Fri Oct 12 12:25:15 2012  URABE Shyouhei  <shyouhei@ruby-lang.org>

* error.c (name_err_to_s): we need not infect msg.

* test/ruby/test_exception.rb (TestException#test_exception_to_s_should_not_propagate_untrustedness): test for it.

Fri Jun 29 21:26:05 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* eval.c (stack_extend): prevent ALLOCA_N, which reserves a memory
	  space with for restoring machine stack stored in each threads, from
	  optimization out.  backport r34278 from the trunk.

Mon Jun 18 18:32:43 2012  Martin Bosslet  <Martin.Bosslet@googlemail.com>

* backport r32609 from trunk.

* ext/openssl/ossl_hmac.c: Revert checking return type of
	  HMAC_Init_ex as it is not compatible with OpenSSL < 1.0.0.

Mon Jun 18 18:32:43 2012  Martin Bosslet  <Martin.Bosslet@googlemail.com>

* backport r32606 from trunk.

* ext/openssl/ossl_digest.c: Check return value of EVP_DigestInit_ex.
	* ext/openssl/ossl_hmac.c: Check return value of HMAC_Init_ex.
	  Thanks, Jared Jennings, for the patch.
	  [ Ruby 1.9 - Bug #4944 ] [ruby-core:37670]

Sun Jun 10 03:00:21 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* eval.c (ruby_setjmp): need to save the stack after r2 (the Table
	  of Contents on ppc64) is saved onto the stack by getcontext().
	  based on <https://bugzilla.redhat.com/show_bug.cgi?id=628715>.
	  Bug#4411

Thu Jun  7 19:00:35 2012  Kenta Murata <mrkn@mrkn.jp>

* ext/bigdecimal/bigdecimal.c (VpMemAlloc): Fixes a bug reported
	  by Drew Yao <ayao at apple.com>

Wed Jun  6 15:09:00 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* eval.c (rb_thread_join), ext/thread/thread.c (wake_one): adjusts
	  targets of rest waiting threads to join.  [ruby-core:23457]

Wed Jun  6 14:44:13 2012  Kenta Murata  <mrkn@mrkn.jp>

* bignum.c (rb_big2dbl), test/ruby/test_bignum.rb (test_to_f):
	  A negative Bignum out of Float range should be converted to -Infinity.
	  [ruby-core:30492] [Bug #3362]

Wed Jun  6 14:06:02 2012  Tanaka Akira  <akr@fsij.org>

* lib/webrick/utils.rb: fix fcntl call.

* lib/drb/unix.rb: ditto.

Mon May 21 16:29:47 2012  Akinori MUSHA  <knu@iDaemons.org>

* ext/syslog/syslog.c (mSyslog_inspect): Make sure self is a
	  module before calling rb_class2name().

Fri May 11 14:09:48 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* ext/bigdecimal/bigdecimal.c (PUSH): to prevent VALUE from GC,
	  must not cast it to unsigned long, which may be shorter than
	  VALUE, and the result can be mere garbage.

Sat Apr 14 18:51:41 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* bignum.c (rb_big2str0): prevent working clone from
	  GC. [exerb-dev:0578].  patched by MURASE Masamitsu
	  <masamitsu.murase AT gmail.com> at [exerb-dev:0580]

Fri Mar  2 11:44:33 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* marshal.c (mark_dump_arg): mark destination string.  patch by
	  Vit Ondruch.  [Bug #4339]

* marshal.c (clear_dump_arg, clear_load_arg): clean up also data
	  tables as same as symbols tables.

Fri Mar  2 11:44:33 2012  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* marshal.c (struct {dump,load}_arg): manage with dfree, instead
	  of using local variable which may be moved by context switch.
	  [ruby-dev:39425]

Wed Feb  8 14:06:59 2012  Hiroshi Nakamura  <nahi@ruby-lang.org>

* ext/openssl/ossl_ssl.c: Add SSL constants and allow to unset SSL
	  option to prevent BEAST attack. See [Bug #5353].

In OpenSSL, OP_DONT_INSERT_EMPTY_FRAGMENTS is used to prevent
	  TLS-CBC-IV vulunerability described at
	  http://www.openssl.org/~bodo/tls-cbc.txt
	  It's known issue of TLSv1/SSLv3 but it attracts lots of attention
	  these days as BEAST attack. (CVE-2011-3389)

Until now ossl sets OP_ALL at SSLContext allocation and call
	  SSL_CTX_set_options at connection.  SSL_CTX_set_options updates the
	  value by using |= so bits set by OP_ALL cannot be unset afterwards.

This commit changes to call SSL_CTX_set_options only 1 time for each
	  SSLContext. It sets the specified value if SSLContext#options= are
	  called and sets OP_ALL if not.

To help users to unset bits in OP_ALL, this commit also adds several
	  constant to SSL such as
	  OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS.  These constants were
	  not exposed in Ruby because there's no way to unset bits in OP_ALL
	  before.

Following is an example to enable 0/n split for BEAST prevention.

ctx.options = OP_ALL & ~OP_DONT_INSERT_EMPTY_FRAGMENTS

* test/openssl/test_ssl.rb: Test above option exists.

Wed Dec 28 21:34:23 2011  URABE Shyouhei  <shyouhei@ruby-lang.org>

* string.c (rb_str_hash): randomize hash to avoid algorithmic
	  complexity attacks. CVE-2011-4815

* st.c (strhash): ditto.

* string.c (Init_String): initialization of hash_seed to be at the
	  beginning of the process.

* st.c (Init_st): ditto.

Thu Dec  8 11:57:04 2011  Tanaka Akira  <akr@fsij.org>

* inits.c (rb_call_inits): call Init_RandomSeed at first.

* random.c (seed_initialized): defined.
	  (fill_random_seed): extracted from random_seed.
	  (make_seed_value): extracted from random_seed.
	  (rb_f_rand): initialize random seed at first.
	  (initial_seed): defined.
	  (Init_RandomSeed): defined.
	  (Init_RandomSeed2): defined.
	  (rb_reset_random_seed): defined.
	  (Init_Random): call Init_RandomSeed2.

Sat Dec 10 20:44:23 2011  Tanaka Akira  <akr@fsij.org>

* lib/securerandom.rb: call OpenSSL::Random.seed at the
	  SecureRandom.random_bytes call.
	  insert separators for array join.
	  patch by Masahiro Tomita.  [ruby-dev:44270]

Mon Oct 17 04:20:22 2011  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* mkconfig.rb: fix for continued lines.  based on a patch from
	  Marcus Rueckert <darix AT opensu.se> at [ruby-core:20420].

Mon Oct 17 04:19:39 2011  Yukihiro Matsumoto  <matz@ruby-lang.org>

* numeric.c (flo_cmp): Infinity is greater than any bignum
	  number.  [ruby-dev:38672]

* bignum.c (rb_big_cmp): ditto.

Mon Oct 17 03:56:12 2011  Yusuke Endoh  <mame@tsg.ne.jp>

* ext/openssl/ossl_x509store.c (ossl_x509store_initialize): initialize
	  store->ex_data.sk.  [ruby-core:28907] [ruby-core:23971]
	  [ruby-core:18121]

Thu Jun 30 12:52:56 2011  WATANABE Hirofumi  <eban@ruby-lang.org>

* ext/tk/extconf.rb (intptr_t, uintptr_t): support for the latest ActiveTcl with mingw.

Sun Jun 26 17:52:32 2011  Nobuhiro Iwamatsu  <iwamatsu@nigauri.org>

* ext/openssl/ossl_ssl.c: By trunk@31346, function check of SSLv2 is executed.
        However, the problem is not revised in this.
        This adds the control of using function of SSLv2 in made macro by function check.

Sun Jun 26 17:52:32 2011  Nobuhiro Iwamatsu  <iwamatsu@nigauri.org>

* ext/openssl/extconf.rb: Should check SSLv2_*method.
	  openssl compiled with "no-ssl2" the extconf don't fail
	  when running `make' having this compilation errors.
	  Patched by Laurent Arnoud. fixes #4562, #4556

Sun Jun 26 17:46:43 2011  URABE Shyouhei  <shyouhei@ruby-lang.org>

* ext/tk/extconf.rb: copy from trunk, as requested by Hidetoshi NAGAI.

Thu Jun 23 18:38:43 2011  Hiroshi Nakamura  <nahi@ruby-lang.org>

backported r26281 from ruby_1_8

* lib/webrick/accesslog.rb (WEBrick::AccessLog.format): log parameter
	  embedding did not work. See #4913.

* test/webrick/test_accesslog.rb: Add for test it.

Thu Jun 16 22:55:02 2011  Hiroshi Nakamura  <nahi@ruby-lang.org>

* test/test_securerandom.rb: Add testcase.  This testcase does NOT aim
	  to test cryptographically strongness and randomness.  It includes
	  the test for PID recycle issue of OpenSSL described in #4579 but
	  it's disabled by default.

Mon Jun 13 18:33:04 2011  Tanaka Akira  <akr@fsij.org>

* lib/securerandom.rb (SecureRandom.random_bytes): modify PRNG state
	  to prevent random number sequence repeatation at forked
	  child process which has same pid.
	  reported by Eric Wong.  [ruby-core:35765]

Thu Jun  2 18:33:51 2011  URABE Shyouhei  <shyouhei@ruby-lang.org>

* variable.c (rb_const_get_0):  Fix  previous change.   There were
	  possibilities   when   an   autoload-specified   library   lacks
	  definition of  the constant  it was bound  to.  Once  after such
	  library had  already beed loaded, the autoload  engine shall not
	  reload  it.   Instead  the  interpreter have  to  consider  such
	  constant nonexistent.  It results in a const_missing situation.

* variable.c (rb_autoload_load): ditto.

* variable.c (autoload_node): ditto.

Thu Jun  2 18:28:58 2011  URABE Shyouhei  <shyouhei@ruby-lang.org>

* variable.c (rb_autoload_load):  There is a  race condition while
	  autoloading.  When two or more threads touch a single autoloaded
	  constant at  a time,  one of them  does the require,  but others
	  behave  oddly.   To  fix  this  situation we  now  refrain  from
	  deleting the autoload table while someone is doing the autoload.
	  That  deletion is  deferred to  a  point where  a require  ended
	  successfully.  Doing so make it possible for multiple threads to
	  enter autoloading at the same  time but the require is protected
	  against  multiple simultaneous  entrance anyway  so all  but one
	  thread  gets blocked  at that  point.   So with  it, touching  a
	  constant that gets autoloaded cause those threads to block until
	  there is another one that does the same thing.
	  [ruby-core:36308] (#921)

* variable.c (rb_const_get_0): ditto.

* variable.c (autoload_node): ditto.

* variable.c (autoload_delete): ditto.

Mon May 30 10:58:17 2011  Hiroshi Nakamura  <nahi@ruby-lang.org>

* lib/logger.rb (Logger::ProgName): do not depend on subversion
	  keyword ($Id: ChangeLog 41678 2013-06-27 11:56:26Z shyouhei $). ProgName with revision number was written in the
	  header line of each logfile for ease of tracking what version user
	  is using in troubleshooting.  Logger is already stable enough.

Sat May 21 07:33:54 2011  Yusuke Endoh  <mame@tsg.ne.jp>

* ext/zlib/zlib.c (zstream_append_input2): add RB_GC_GUARD.
	  This caused failure when test/csv is executed with GC.stress = true.

Sat May 21 05:43:03 2011  URABE Shyouhei  <shyouhei@ruby-lang.org>

* eval.c (rb_thread_atfork): When a ruby process forks, its random
	  seed shall be reinitialized to prevent CVE-2003-0900 situation.
	  This bug affects for 1.8 and earlier series, but not for 1.9.
	  fixed [ruby-core:34944].

* io.c (pipe_open): ditto.

* random.c (rb_reset_random_seed): ditto.

* intern.h (rb_reset_random_seed): ditto.

Sat May 21 04:55:15 2011  Akinori MUSHA  <knu@iDaemons.org>

* lib/uri/generic.rb (#route_from_path): Fix a bug where
	  URI('http://h/b/').route_to('http://h/b') wrongly returned './'
	  (should be '../b'). [Bug #4476]

Sat May 21 04:54:20 2011  Akinori MUSHA  <knu@iDaemons.org>

* lib/fileutils.rb (FileUtils#touch): Fix corrupted output.
	  ref [ruby-dev:43401]

Sat May 21 02:10:09 2011  Yukihiro Matsumoto  <matz@ruby-lang.org>

* re.h (RMATCH_REGS): parenthesize cast expression.  suggested
	  from Nikolai Weibull in [ruby-core:35825].

Sat May 21 01:32:08 2011  NAKAMURA Usaku  <usa@ruby-lang.org>

backported r31286 from trunk

* numeric.c (ruby_float_step): wrong loop condition.
	  fixes [ruby-core:35753], reported by Joey Zhou.

* test/ruby/test_range.rb (TestRange#test_step_ruby_core_35753):
	  test above change.

Sat May 21 00:55:21 2011  NARUSE, Yui  <naruse@ruby-lang.org>

* ext/zlib/zlib.c (gzfile_check_footer): ISIZE (Input SIZE) in gzip's
	header is the size of uncompressed input data modulo 2^32.
	[ruby-core:34481] http://www.ietf.org/rfc/rfc1952.txt

Fri May 20 23:46:44 2011  NAKAMURA Usaku  <usa@ruby-lang.org>

* ext/socket/{getaddrinfo,getnameinfo}.c: include winsock2.h only when
	  specified to use winsock2 by user.
	  this problem is reported by kosaki.

Fri May 20 23:23:45 2011  NAKAMURA Usaku  <usa@ruby-lang.org>

* ext/socket/socket.c (make_addrinfo): skip IPv6 addresses when ruby
	  doesn't support IPv6 but system supports it.
	  [ruby-dev:42944] (#4230)

Fri May 20 23:10:07 2011  NAKAMURA Usaku  <usa@ruby-lang.org>

* win32/README.win32: note to need NT based OS to build ruby.

* win32/{configure.bat,setup.mak}: backport current build method from
	  trunk. [ruby-dev:42893] (#4206)

Fri May 20 23:06:31 2011  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* Backported the fix at
	  Mon Sep 13 09:23:58 2010  NARUSE, Yui  <naruse@ruby-lang.org>

* ext/openssl/ossl_bn.c (ossl_bn_is_prime): fix comparison
	  with rb_scan_args. Before this fix, OpenSSL::BN#prime?
	  is fully broken.

Fri May 20 23:06:31 2011  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* Backported the fix at
	  Mon Oct  4 09:30:42 2010  NARUSE, Yui  <naruse@ruby-lang.org>

* ext/openssl/lib/openssl/bn.rb (Integer#to_bn): OpenSSL::BN.new
	  accepts only Strings, so call Integer#to_s(16).
	  16 is for an optimization. [ruby-dev:42336]

Fri Feb 18 21:18:55 2011  Shugo Maeda  <shugo@ruby-lang.org>

* test/ruby/test_exception.rb (TestException::test_to_s_taintness_propagation):
	  Test for below.

Fri Feb 18 21:18:55 2011  URABE Shyouhei  <shyouhei@ruby-lang.org>

* error.c (exc_to_s): untainted strings can be tainted via
	  Exception#to_s, which enables attackers to overwrite sane strings.
	  Reported by: Yusuke Endoh <mame at tsg.ne.jp>.

* error.c (name_err_to_s): ditto.

Fri Feb 18 21:17:22 2011  Shugo Maeda  <shugo@ruby-lang.org>

* lib/fileutils.rb (FileUtils::remove_entry_secure): there is a
	  race condition in the case where the given path is a directory,
	  and some other user can move that directory, and create a
	  symlink while this method is executing.
	  Reported by: Nicholas Jefferson <nicholas at pythonic.com.au>

Fri Feb 18 19:46:46 2011  NAKAMURA Usaku  <usa@ruby-lang.org>

* win32/win32.c (init_stdhandle): backport mistake of r29382.
	  some code are needless in ruby 1.8.
	  [ruby-core:34579]

Fri Feb 18 19:22:17 2011  URABE Shyouhei  <shyouhei@ruby-lang.org>

* configure.in: revert revision r29854.  This revision introduced
	  binary incompatibilities on some circumstances.  The bug that
	  revision was fixing gets reopened by this reversion.
	  [ruby-dev:43152] cf. [Bug #2553]

Thu Dec 23 12:22:35 2010  Tanaka Akira  <akr@fsij.org>

* lib/resolv.rb (Resolv::IPv4::Regex): make it only accept 0 to 255.
	  [ruby-core:29501]

Tue Dec 21 01:43:01 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* lib/webrick/https.rb: uninitialized instance variables.
	  Backport a part of r20864 for ruby_1_8.

Sat Dec  4 11:35:15 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* lib/mkmf.rb (init_mkmf): needs default library path even if
	  cross compiling.

Sat Dec  4 11:25:02 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* re.c (rb_reg_regcomp): should succeed the taint status from the
	  origin. [ruby-core:33338]

Thu Dec  2 21:13:42 2010  URABE Shyouhei  <shyouhei@ruby-lang.org>

* Makefile.in (fake.rb): need to expand the topdir in case of it
	  being relative, a patch from Luis Lavena <luislavena at gmail.com>.
	  [ruby-core:33466]

Wed Nov 24 18:24:26 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* ext/socket/extconf.rb: backported entirely from ruby_1_8, with small
	  modifications for the difference of mkmf.rb.

Wed Nov 24 16:24:24 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* mkconfig.rb (patchlevel): config.status may not contain
	  PATCHLEVEL even if other version numbers exist.

Wed Nov 24 16:18:02 2010  URABE Shyouhei  <shyouhei@ruby-lang.org>

* win32/Makefile.sub ($(RCFILES)): no revision.h in this
	  branch, a patch from Luis Lavena <luislavena at gmail.com>.
	  [ruby-core:33310]

* cygwin/GNUmakefile.in ($(RCFILES)): ditto.

Wed Nov 24 15:44:11 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* ext/socket/extconf.rb (getaddrinfo): should initialize winsock on
	  windows.

Wed Nov 24 13:55:21 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* win32/setup.mak: use findstr.exe instead of find.exe, because all
	  target build platforms should have findstr.exe, and, find.exe often
	  means another command such as cygwin's.

Wed Nov 24 13:27:34 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* ext/stringio/stringio.c (strio_getline): fix for "" as separator.
	  [ruby-dev:34591] (Backport r17739 by Yusuke Endoh from trunk).

Wed Nov 24 13:27:20 2010  Kazuhiro NISHIYAMA  <zn@mbf.nifty.com>

* lib/net/pop.rb (Net::POP3#set_all_uids): speed
	  up. a patch from <m-sumi AT techfirm.co.jp> [ruby-list:45047]

Tue Nov 23 20:48:10 2010  Shugo Maeda  <shugo@ruby-lang.org>

* lib/net/imap.rb (initialize): sets sync_close to true.
	  Thanks, Hiroshi NAKAMURA.  [ruby-core:31753]

Tue Nov 23 17:09:14 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* lib/pathname.rb (relative_path_from): backport r23093 and r25440
	  from ruby_1_9_2.  [ruby-core:32415]

Mon Nov 22 14:13:45 2010  Masaki Suketa <masaki.suketa@nifty.ne.jp>

* ext/win32ole/win32ole.c: fix checking version of GCC.

Mon Nov 22 14:13:45 2010  Masaki Suketa <masaki.suketa@nifty.ne.jp>

* ext/win32ole/win32ole.c: NONAMELESSUNION defined only if gcc
	  version is older than 3.4.4. [ruby-core:31567] [Bug #3637]
	* ext/win32ole/extconf.rb: ditto.

Fri Nov 19 19:28:00 2010  URABE Shyouhei  <shyouhei@ruby-lang.org>

* Makefile.in (fake.rb): hook needed to fake mkmf.rb.
	  #2531 [ruby-core:27327]

Mon Oct 18 10:21:01 2010  NARUSE, Yui  <naruse@ruby-lang.org>

* lib/net/http.rb (transport_request): @socket may be nil.
	  patched by Egbert Eich [ruby-core:32829]

Fri Oct  8 10:51:56 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* common.mk (RBCONFIG): depends on version.h due to
	  RUBY_PATCHLEVEL.  [ruby-core:32709]

Thu Oct  7 18:10:35 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* cygwin/GNUmakefile.in, win32/Makefile.sub (RCFILES): depend on
	  real config.rb file.  [ruby-core:32709]

Sun Oct  3 18:30:23 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* parse.y (rb_intern): should check symbol table overflow.
	  #3900 [ruby-dev:42330]

Fri Oct  1 15:12:05 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* win32/win32.c (init_stdhandle): redirect unopened IOs to NUL.
	  backport r11362 from trunk. [ruby-core:31445]

Mon Aug 23 11:42:41 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* ext/openssl/ossl_asn1.c (obj_to_asn1bool): fixed ASN1::Boolean
	  encoding issue for OpenSSL 1.0.0 compatibility.
	  ASN1::Boolean.new(false).to_der wrongly generated "\1\1\377" which
	  means 'true'.  [BUG:3735] 
	  
	  ASN1_TYPE_set of OpenSSL <= 0.9.8 treats value 0x100 as 'false' but
	  OpenSSL >= 1.0.0 treats it as 'true'.  ruby-ossl was using 0x100 for
	  'false' for backward compatibility.  Just use 0x0 for the case
	  OpenSSL >= OpenSSL 0.9.7.

* test/openssl/test_asn1.rb: test added.

Tue Aug 10 17:35:49 2010  NARUSE, Yui  <naruse@ruby-lang.org>

* lib/webrick/httprequest.rb (WEBrick::HTTPRequest::parse_uri):
	  rollup leading slashes. [ruby-core:31657]
	  patched by Jamison Wilde
	  NOTE: //authority/path is valid relative URI both RFC2396 and
	  RFC3986. So when give a relative URI-like string to URI lib,
	  users must care leading slashes.

Fri Jul 30 08:51:51 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* file.c (file_expand_path): home directory must be absolute.
	  [ruby-core:31537]

Fri Jul 30 08:33:20 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* file.c (file_expand_path): should check if could find user.
	  [ruby-core:31538]

Thu Jul 29 22:43:57 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* lib/webrick/ssl.rb (WEBrick::Utils.create_self_signed_cert): wrongly
	  created dummy SSL certificate with version == 3 (no such version) and
	  serial == 0 (must be >0).

Sat Jul 24 15:44:29 2010  Masaki Suketa <masaki.suketa@nifty.ne.jp>

* ext/win32ole/win32ole.c (fev_initialize): initialize pTypeInfo.
	  [ruby-core:31304][Bug #3576].

Tue Jul 13 21:46:38 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* ext/openssl/ossl_config.c, ext/openssl/lib/openssl/config.rb,
	  ext/openssl/lib/openssl.rb: reimplement OpenSSL::Config in Ruby. Now
	  it should work on windows.

* test/openssl/test_config.rb: added tests for OpenSSL::Config#dup.

Mon Jul 12 22:26:00 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* ext/openssl/ossl_config.c (ossl_config_copy): wrongly updating the
	  given object with uninitialized CONF data.  now
	  OpenSSL::Config#clone works as expected; cloning the config instead of
	  SEGV or empty definition.

* test/openssl/test_config.rb: added tests for Config#clone.

Thu Jul  8 13:43:13 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>

* test/openssl/test_config.c: added tests for all Config methods.

Wed Jul  7 13:24:24 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* file.c (ruby_find_basename): set correct baselen.

Fri Jul  2 23:34:45 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* file.c (ruby_find_basename, ruby_find_extname): split from
	  rb_file_s_basename() and rb_file_s_extname().

* util.c (ruby_add_suffix): support arbitrary length of the suffix
	  to get rid of the potential buffer overflow.
	  reported by tarui.

Sat Jul 10 10:51:29 2010  KOSAKI Motohiro  <kosaki.motohiro@gmail.com>

* configure.in: fix use_context condition inversion.
	[Bug #2553][ruby-core:31164]. Thanks, Andre Nathan.

Wed Jun 23 21:36:45 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* configure.in: avoid getcontext() overhead if possible.
	[ruby-core:27380][Bug #2553]
	Thanks, Joe Damato, Dan Peterson and Patrick Mohr.

Wed Jan 13 06:54:44 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* configure.in: check for if struct timezone is defined.

* missing.h (struct timezone): define if not defined.

* win32/win32.h (struct timezone): defined in the newer w32api.
	  [ruby-core:27515]

Sun Aug 15 19:59:58 2010  Yuki Sonoda (Yugui)  <yugui@yugui.jp>

* lib/webrick/httpresponse.rb (WEBrick::HTTPResponse#set_error):
	  Fix for possible cross-site scripting (CVE-2010-0541). 
	  Found by Apple, reported by Hideki Yamane.
	  Patch by Hirokazu Nishio <nishio.hirokazu AT gmail.com>.

Sat Jul 17 15:19:58 2010  KOSAKI Motohiro  <kosaki.motohiro@gmail.com>

* configure.in: Change AC_PREREQ from 2.58 to 2.60 because
	  AC_CASE macro require 2.60 or later. Thanks, Mitsuru SHIMAMURA.
	  [Bug #3579] [ruby-dev:41856]

Wed Jun 23 22:22:42 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>

* test/optparse/test_summary.rb: fixed superclass so that it run
	  solely.

Wed Jun 23 21:54:17 2010  URABE Shyouhei  <shyouhei@ruby-lang.org>

* marshal.c, test/ruby/test_marshal.rb: Revert r25230.  This test
	  is troublesome.

Mon Jun 21 18:12:15 2010  NAKAMURA Usaku  <usa@ruby-lang.org>

* ext/openssl/extconf.rb: check some functions added at OpenSSL 1.0.0.

* ext/openssl/ossl_engine.c (ossl_engine_s_load): use engines which
	  exists.