merges r28869 from trunk into ruby_1_9_2.

--
* complex.c (nucomp_marshal_load): should check the argument.
  [ruby-core:31622]

* rational.c (nurat_marshal_load): ditto

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_2@28874 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,10 @@
+Thu Aug  5 18:36:11 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* complex.c (nucomp_marshal_load): should check the argument.
+	  [ruby-core:31622]
+
+	* rational.c (nurat_marshal_load): ditto
+
 Mon Aug  2 16:34:32 2010  NAKAMURA Usaku  <usa@ruby-lang.org>
 
 	* thread_win32.c (native_thread_join): need to wait thread, of course.

complex.c

@@ -1239,6 +1239,7 @@ static VALUE
 nucomp_marshal_load(VALUE self, VALUE a)
 {
     get_dat1(self);
+    Check_Type(a, T_ARRAY);
     dat->real = RARRAY_PTR(a)[0];
     dat->imag = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);

rational.c

@@ -1577,6 +1577,7 @@ static VALUE
 nurat_marshal_load(VALUE self, VALUE a)
 {
     get_dat1(self);
+    Check_Type(a, T_ARRAY);
     dat->num = RARRAY_PTR(a)[0];
     dat->den = RARRAY_PTR(a)[1];
     rb_copy_generic_ivar(self, a);

test/ruby/test_complex.rb

@@ -633,6 +633,11 @@ class Complex_Test < Test::Unit::TestCase
       assert_equal(c, c2)
       assert_instance_of(Complex, c2)
     end
+
+    bug3656 = '[ruby-core:31622]'
+    assert_raise(TypeError, bug3656) {
+      Complex(1,2).marshal_load(0)
+    }
   end
 
   def test_parse

test/ruby/test_rand.rb

@@ -415,4 +415,11 @@ END
       assert_equal(r1, r2)
     }
   end
+
+  def test_marshal
+    bug3656 = '[ruby-core:31622]'
+    assert_raise(TypeError, bug3656) {
+      Random.new.marshal_load(0)
+    }
+  end
 end

test/ruby/test_rational.rb

@@ -797,6 +797,11 @@ class Rational_Test < Test::Unit::TestCase
     assert_raise(ZeroDivisionError){
       Marshal.load("\x04\bU:\rRational[\ai\x06i\x05")
     }
+
+    bug3656 = '[ruby-core:31622]'
+    assert_raise(TypeError, bug3656) {
+      Rational(1,2).marshal_load(0)
+    }
   end
 
   def test_parse