From 24ed86fcc71f821cedc3311bfa08b7ccf42b9d5f Mon Sep 17 00:00:00 2001
From: Jeremy Evans <code@jeremyevans.net>
Date: Thu, 13 Jun 2019 12:41:49 -0700
Subject: [PATCH] Do not allow modifications to ENV if ENV if frozen

None of the ENV specific methods checked whether ENV was frozen.
This adds the appropriate checks to any potentionally mutating
method.

Fixes [Bug #15920]
---
 hash.c                | 12 +++++++++++-
 test/ruby/test_env.rb | 20 ++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/hash.c b/hash.c
index 2982afad9d..ecf8dbbd29 100644
--- a/hash.c
+++ b/hash.c
@@ -4626,6 +4626,7 @@ env_delete_m(VALUE obj, VALUE name)
 {
     VALUE val;
 
+    rb_check_frozen(obj);
     val = env_delete(name);
     if (NIL_P(val) && rb_block_given_p()) rb_yield(name);
     return val;
@@ -4959,6 +4960,7 @@ ruby_unsetenv(const char *name)
 static VALUE
 env_aset_m(VALUE obj, VALUE nm, VALUE val)
 {
+    rb_check_frozen(obj);
     return env_aset(nm, val);
 }
 
@@ -5170,6 +5172,7 @@ env_reject_bang(VALUE ehash)
     int del = 0;
 
     RETURN_SIZED_ENUMERATOR(ehash, 0, 0, rb_env_size);
+    rb_check_frozen(ehash);
     keys = env_keys();
     RBASIC_CLEAR_CLASS(keys);
     for (i=0; i<RARRAY_LEN(keys); i++) {
@@ -5200,6 +5203,7 @@ static VALUE
 env_delete_if(VALUE ehash)
 {
     RETURN_SIZED_ENUMERATOR(ehash, 0, 0, rb_env_size);
+    rb_check_frozen(ehash);
     env_reject_bang(ehash);
     return envtbl;
 }
@@ -5280,6 +5284,7 @@ env_select_bang(VALUE ehash)
     int del = 0;
 
     RETURN_SIZED_ENUMERATOR(ehash, 0, 0, rb_env_size);
+    rb_check_frozen(ehash);
     keys = env_keys();
     RBASIC_CLEAR_CLASS(keys);
     for (i=0; i<RARRAY_LEN(keys); i++) {
@@ -5310,6 +5315,7 @@ static VALUE
 env_keep_if(VALUE ehash)
 {
     RETURN_SIZED_ENUMERATOR(ehash, 0, 0, rb_env_size);
+    rb_check_frozen(ehash);
     env_select_bang(ehash);
     return envtbl;
 }
@@ -5355,6 +5361,7 @@ rb_env_clear(void)
     VALUE keys;
     long i;
 
+    rb_check_frozen(envtbl);
     keys = env_keys();
     for (i=0; i<RARRAY_LEN(keys); i++) {
 	VALUE val = rb_f_getenv(Qnil, RARRAY_AREF(keys, i));
@@ -5707,11 +5714,12 @@ env_reject(void)
  * an Array.  Returns +nil+ if when the environment is empty.
  */
 static VALUE
-env_shift(void)
+env_shift(VALUE self)
 {
     char **env;
     VALUE result = Qnil;
 
+    rb_check_frozen(self);
     env = GET_ENVIRON(environ);
     if (*env) {
 	char *s = strchr(*env, '=');
@@ -5762,6 +5770,7 @@ env_replace(VALUE env, VALUE hash)
     VALUE keys;
     long i;
 
+    rb_check_frozen(env);
     keys = env_keys();
     if (env == hash) return env;
     hash = to_hash(hash);
@@ -5797,6 +5806,7 @@ env_update_i(VALUE key, VALUE val)
 static VALUE
 env_update(VALUE env, VALUE hash)
 {
+    rb_check_frozen(env);
     if (env == hash) return env;
     hash = to_hash(hash);
     rb_hash_foreach(hash, env_update_i, 0);
diff --git a/test/ruby/test_env.rb b/test/ruby/test_env.rb
index 6343642ac1..2b921ed0ed 100644
--- a/test/ruby/test_env.rb
+++ b/test/ruby/test_env.rb
@@ -514,6 +514,26 @@ def test_frozen
     end
   end
 
+  def test_ENV_frozen
+    assert_separately([], <<-EOS)
+      assert_equal(ENV, ENV.freeze)
+      assert_equal(true, ENV.frozen?)
+      assert_raise(FrozenError) { ENV['a'] = 'b' }
+      assert_raise(FrozenError) { ENV.store('a', 'b') }
+      assert_raise(FrozenError) { ENV.delete('a') }
+      assert_raise(FrozenError) { ENV.delete_if{} }
+      assert_raise(FrozenError) { ENV.keep_if{} }
+      assert_raise(FrozenError) { ENV.clear }
+      assert_raise(FrozenError) { ENV.reject!{} }
+      assert_raise(FrozenError) { ENV.select!{} }
+      assert_raise(FrozenError) { ENV.filter!{} }
+      assert_raise(FrozenError) { ENV.shift }
+      assert_raise(FrozenError) { ENV.replace({}) }
+      assert_raise(FrozenError) { ENV.update({}) }
+    EOS
+
+  end
+
   def test_shared_substring
     bug12475 = '[ruby-dev:49655] [Bug #12475]'
     n = [*"0".."9"].join("")*3
-- 
2.21.0