ox 2.14.28 → 2.14.29

data/ext/ox/extconf.rb

@@ -46,6 +46,9 @@ have_func('rb_ext_ractor_safe', 'ruby.h')
 have_func('pthread_mutex_init')
 have_func('rb_enc_interned_str')
 have_func('index')
+# Seeds the name cache hash. Not on every implementation, so cache.c falls back
+# to String#hash, which is per process randomized everywhere it matters.
+have_func('rb_hash_start', 'ruby.h')
 
 have_header('ruby/st.h')
 have_header('sys/uio.h')

data/ext/ox/gen_load.c

@@ -21,13 +21,11 @@ static void nomode_instruct(PInfo pi, const char *target, Attr attrs, const char
 static void add_doctype(PInfo pi, const char *docType);
 static void add_comment(PInfo pi, const char *comment);
 static void add_cdata(PInfo pi, const char *cdata, size_t len);
-static void add_text(PInfo pi, char *text, int closed);
+static void add_text(PInfo pi, char *text, size_t len, int closed);
 static void add_element(PInfo pi, const char *ename, Attr attrs, int hasChildren);
 static void end_element(PInfo pi, const char *ename);
 static void add_instruct(PInfo pi, const char *name, Attr attrs, const char *content);
 
-extern ParseCallbacks ox_obj_callbacks;
-
 struct _parseCallbacks _ox_gen_callbacks = {
     instruct, /* instruct, */
     add_doctype,
@@ -163,14 +161,18 @@ static void nomode_instruct(PInfo pi, const char *target, Attr attrs, const char
                 }
             } else if (0 == strcmp("mode", attrs->name)) {
                 if (0 == strcmp("object", attrs->value)) {
-                    pi->pcb = ox_obj_callbacks;
-                    pi->obj = Qnil;
-                    helper_stack_init(&pi->helpers);
+                    // Only the caller can select object mode.
+                    if (TRACE <= pi->options->trace) {
+                        printf("Object mode processing instruction ignored.\n");
+                    }
                 } else if (0 == strcmp("generic", attrs->value)) {
                     pi->pcb = ox_gen_callbacks;
                 } else if (0 == strcmp("limited", attrs->value)) {
                     pi->pcb = ox_limited_callbacks;
                     pi->obj = Qnil;
+                    // The instruction can appear after the stack has grown, and
+                    // helper_stack_init() only moves head back to base.
+                    helper_stack_cleanup(&pi->helpers);
                     helper_stack_init(&pi->helpers);
                 } else {
                     ox_err_set(&pi->err,
@@ -230,8 +232,8 @@ static void add_cdata(PInfo pi, const char *cdata, size_t len) {
     rb_ary_push(helper_stack_peek(&pi->helpers)->obj, n);
 }
 
-static void add_text(PInfo pi, char *text, int closed) {
-    VALUE s = rb_str_new2(text);
+static void add_text(PInfo pi, char *text, size_t len, int closed) {
+    VALUE s = rb_str_new(text, len);
 
     if (0 != pi->options->rb_enc) {
         rb_enc_associate(s, pi->options->rb_enc);

data/ext/ox/hash_load.c

@@ -92,8 +92,8 @@ static void add_str(PInfo pi, VALUE s) {
     }
 }
 
-static void add_text(PInfo pi, char *text, int closed) {
-    VALUE s = rb_str_new2(text);
+static void add_text(PInfo pi, char *text, size_t len, int closed) {
+    VALUE s = rb_str_new(text, len);
     if (0 != pi->options->rb_enc) {
         rb_enc_associate(s, pi->options->rb_enc);
     }
@@ -239,7 +239,12 @@ static void end_element_no_attrs(PInfo pi, const char *ename) {
 }
 
 static void finish(PInfo pi) {
+    // Called once per yielded entity and once after the loop, so the pointer
+    // and the count have to go with the block.
     xfree(pi->marked);
+    pi->marked    = NULL;
+    pi->mark_size = 0;
+    pi->mark_cnt  = 0;
 }
 
 static void set_encoding_from_instruct(PInfo pi, Attr attrs) {

data/ext/ox/helper.h

@@ -6,14 +6,17 @@
 #ifndef OX_HELPER_H
 #define OX_HELPER_H
 
+#include <stdbool.h>
+
 #include "type.h"
 
 #define HELPER_STACK_INC 16
 
 typedef struct _helper {
-    ID    var;  /* Object var ID */
-    VALUE obj;  /* object created or Qundef if not appropriate */
-    Type  type; /* type of object in obj */
+    ID    var;   /* Object var ID, or a Struct member index when index is set */
+    VALUE obj;   /* object created or Qundef if not appropriate */
+    Type  type;  /* type of object in obj */
+    bool  index; /* var is a member index and not an ID */
 } *Helper;
 
 typedef struct _helperStack {
@@ -58,9 +61,10 @@ inline static Helper helper_stack_push(HelperStack stack, ID var, VALUE obj, Typ
         stack->tail = stack->head + toff;
         stack->end  = stack->head + len + HELPER_STACK_INC;
     }
-    stack->tail->var  = var;
-    stack->tail->obj  = obj;
-    stack->tail->type = type;
+    stack->tail->var   = var;
+    stack->tail->obj   = obj;
+    stack->tail->type  = type;
+    stack->tail->index = false;  // obj_load.c sets its own
     stack->tail++;
 
     return stack->tail - 1;

data/ext/ox/intern.c

@@ -68,7 +68,12 @@ static VALUE form_id(const char *str, size_t len) {
 }
 
 void ox_hash_init(void) {
-    VALUE cache_class = rb_define_class_under(Ox, "Cache", rb_cObject);
+    VALUE cache_class;
+
+    // Before the first cache exists, so no name is ever hashed unseeded.
+    ox_hash_seed_init();
+
+    cache_class = rb_define_class_under(Ox, "Cache", rb_cObject);
 #if RUBY_API_VERSION_CODE >= 30200
     rb_undef_alloc_func(cache_class);
 #endif

data/ext/ox/obj_load.c

@@ -5,6 +5,7 @@
 
 #include <errno.h>
 #include <stdarg.h>
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -15,24 +16,27 @@
 #include "ox.h"
 #include "ruby.h"
 #include "ruby/encoding.h"
+#include "time_conv.h"
+
+// No Struct has this many members, so a larger index is always out of range.
+#define MAX_STRUCT_INDEX (1 << 24)
 
 static void instruct(PInfo pi, const char *target, Attr attrs, const char *content);
-static void add_text(PInfo pi, char *text, int closed);
+static void add_text(PInfo pi, char *text, size_t len, int closed);
 static void add_element(PInfo pi, const char *ename, Attr attrs, int hasChildren);
 static void end_element(PInfo pi, const char *ename);
 
 static VALUE parse_time(const char *text, VALUE clas);
 static VALUE parse_xsd_time(const char *text, VALUE clas);
 static VALUE parse_double_time(const char *text, VALUE clas);
-static VALUE parse_regexp(const char *text);
+static VALUE parse_regexp(const char *text, PInfo pi);
 
-static ID            get_var_sym_from_attrs(Attr a, void *encoding);
+static ID            get_var_sym_from_attrs(Attr a, void *encoding, bool *indexp);
 static VALUE         get_obj_from_attrs(Attr a, PInfo pi, VALUE base_class);
 static VALUE         get_class_from_attrs(Attr a, PInfo pi, VALUE base_class);
 static VALUE         classname2class(const char *name, PInfo pi, VALUE base_class);
 static unsigned long get_id_from_attrs(PInfo pi, Attr a);
 static CircArray     circ_array_new(void);
-static void          circ_array_free(CircArray ca);
 static void          circ_array_set(CircArray ca, VALUE obj, unsigned long id);
 static VALUE         circ_array_get(CircArray ca, unsigned long id);
 
@@ -143,7 +147,8 @@ static VALUE classname2class(const char *name, PInfo pi, VALUE base_class) {
     if (Qundef == (clas = slot_cache_get(ox_class_cache, name, &slot, 0))) {
         char        class_name[1024];
         char       *s;
-        const char *n = name;
+        char       *class_name_end = class_name + sizeof(class_name) - 1;
+        const char *n              = name;
 
         clas = rb_cObject;
         for (s = class_name; '\0' != *n; n++) {
@@ -159,6 +164,13 @@ static VALUE classname2class(const char *name, PInfo pi, VALUE base_class) {
                 }
                 s = class_name;
             } else {
+                if (class_name_end <= s) {
+                    // Guard the fixed-size stack buffer: an over-long class name
+                    // (from the attacker-controlled `c` attribute in object mode)
+                    // would otherwise overflow class_name[].
+                    set_error(&pi->err, "Invalid classname, too long", pi->str, pi->s);
+                    return Qundef;
+                }
                 *s++ = *n;
             }
         }
@@ -171,13 +183,30 @@ static VALUE classname2class(const char *name, PInfo pi, VALUE base_class) {
     return clas;
 }
 
-static ID get_var_sym_from_attrs(Attr a, void *encoding) {
+// Returns a Struct member index as a Fixnum or an instance variable ID. An ID
+// is odd, so it satisfies FIXNUM_P too; indexp says which one it is.
+static ID get_var_sym_from_attrs(Attr a, void *encoding, bool *indexp) {
+    *indexp = false;
     for (; 0 != a->name; a++) {
         if ('a' == *a->name && '\0' == *(a->name + 1)) {
             const char *val = a->value;
 
             if ('0' <= *val && *val <= '9') {
-                return INT2NUM(atoi(val));
+                // atoi() wrapped past INT_MAX into a negative index, which Ruby
+                // counts from the end. Stopping at INT_MAX is no good either:
+                // FIXNUM_MAX is 2**30 - 1 where long is 32 bits, and INT2NUM of
+                // INT_MAX came back as -1 there.
+                int i = 0;
+
+                for (; '0' <= *val && *val <= '9'; val++) {
+                    i = i * 10 + (*val - '0');
+                    if (MAX_STRUCT_INDEX < i) {
+                        i = MAX_STRUCT_INDEX;
+                        break;
+                    }
+                }
+                *indexp = true;
+                return (ID)INT2NUM(i);
             }
             return ox_id_intern(val, strlen(val));
         }
@@ -212,16 +241,25 @@ static VALUE get_class_from_attrs(Attr a, PInfo pi, VALUE base_class) {
     return Qundef;
 }
 
+// The id indexes the circular reference table, which is grown to fit it, so an
+// unbounded id is an unbounded heap write. Cap it at the document length: every
+// referenced object needs at least one element, so no valid id can exceed it.
 static unsigned long get_id_from_attrs(PInfo pi, Attr a) {
     for (; 0 != a->name; a++) {
         if ('i' == *a->name && '\0' == *(a->name + 1)) {
-            unsigned long id   = 0;
-            const char   *text = a->value;
-            char          c;
+            unsigned long       id    = 0;
+            const unsigned long limit = (unsigned long)(pi->end - pi->str);
+            const char         *text  = a->value;
+            char                c;
 
             for (; '\0' != *text; text++) {
                 c = *text;
                 if ('0' <= c && c <= '9') {
+                    // Checked before the multiply so id can not overflow.
+                    if (limit / 10 < id || limit < id * 10 + (unsigned long)(c - '0')) {
+                        set_error(&pi->err, "circular reference id out of range", pi->str, pi->s);
+                        return 0;
+                    }
                     id = id * 10 + (c - '0');
                 } else {
                     set_error(&pi->err, "bad number format", pi->str, pi->s);
@@ -245,7 +283,8 @@ static CircArray circ_array_new(void) {
     return ca;
 }
 
-static void circ_array_free(CircArray ca) {
+// Also called from ox_parse_ensure() when a parse ends before end_element().
+void ox_circ_array_free(CircArray ca) {
     if (ca->objs != ca->obj_array) {
         xfree(ca->objs);
     }
@@ -281,17 +320,30 @@ static void circ_array_set(CircArray ca, VALUE obj, unsigned long id) {
 static VALUE circ_array_get(CircArray ca, unsigned long id) {
     VALUE obj = Qundef;
 
-    if (id <= ca->cnt) {
+    // id is 0 when the `i` attribute is missing or invalid. Without the lower
+    // bound that reads objs[-1] and hands the word to Ruby as an object.
+    if (0 < id && id <= ca->cnt) {
         obj = ca->objs[id - 1];
     }
     return obj;
 }
 
-static VALUE parse_regexp(const char *text) {
+static VALUE parse_regexp(const char *text, PInfo pi) {
     const char *te;
+    const char *s;
+    char       *b;
+    VALUE       src;
+    size_t      len     = strlen(text);
     int         options = 0;
 
-    te = text + strlen(text) - 1;
+    // The text is Regexp#inspect output, so the shortest it can be is "//".
+    // Below that te would be built from text - 1, which is not a pointer the
+    // string owns.
+    if (len < 2 || '/' != *text) {
+        set_error(&pi->err, "Invalid regexp format", pi->str, pi->s);
+        return Qundef;
+    }
+    te = text + len - 1;
 #ifdef ONIG_OPTION_IGNORECASE
     for (; text < te && '/' != *te; te--) {
         switch (*te) {
@@ -302,7 +354,41 @@ static VALUE parse_regexp(const char *text) {
         }
     }
 #endif
-    return rb_reg_new(text + 1, te - text - 1, options);
+    // The scan above stops on the opening / when there is no closing one, and
+    // without ONIG_OPTION_IGNORECASE it never runs at all. Either way the
+    // length below goes negative if this is not checked.
+    if (te <= text || '/' != *te) {
+        set_error(&pi->err, "Invalid regexp format", pi->str, pi->s);
+        return Qundef;
+    }
+    // rb_reg_new() takes bytes, so it can not be told the document's encoding
+    // and leaves the source ASCII-8BIT. Going through the String also gets
+    // Ruby's own rule, which promotes an ASCII only source to US-ASCII the way
+    // a literal is.
+    src = rb_str_new(0, te - text - 1);
+    b   = RSTRING_PTR(src);
+    // The dumper writes Regexp#inspect, which escapes a / in the source as \/,
+    // so take that back off. A backslash pair is stepped over whole or the /
+    // in "\\/" would be read as the escaped one.
+    s = text + 1;
+    while (s < te) {
+        if ('\\' == *s && s + 1 < te) {
+            if ('/' == s[1]) {
+                *b++ = '/';
+            } else {
+                *b++ = *s;
+                *b++ = s[1];
+            }
+            s += 2;
+        } else {
+            *b++ = *s++;
+        }
+    }
+    rb_str_set_len(src, b - RSTRING_PTR(src));
+    if (0 != pi->options->rb_enc) {
+        rb_enc_associate(src, pi->options->rb_enc);
+    }
+    return rb_reg_new_str(src, options);
 }
 
 static void instruct(PInfo pi, const char *target, Attr attrs, const char *content) {
@@ -315,7 +401,7 @@ static void instruct(PInfo pi, const char *target, Attr attrs, const char *conte
     }
 }
 
-static void add_text(PInfo pi, char *text, int closed) {
+static void add_text(PInfo pi, char *text, size_t len, int closed) {
     Helper h = helper_stack_peek(&pi->helpers);
 
     if (!closed) {
@@ -335,7 +421,7 @@ static void add_text(PInfo pi, char *text, int closed) {
     switch (h->type) {
     case NoCode:
     case StringCode:
-        h->obj = rb_str_new2(text);
+        h->obj = rb_str_new(text, len);
         if (0 != pi->options->rb_enc) {
             rb_enc_associate(h->obj, pi->options->rb_enc);
         }
@@ -381,42 +467,68 @@ static void add_text(PInfo pi, char *text, int closed) {
     case TimeCode: h->obj = parse_time(text, ox_time_class); break;
     case String64Code: {
         unsigned long str_size = b64_orig_size(text);
-        VALUE         v;
-        char         *str = ALLOCA_N(char, str_size + 1);
+        // Decode straight into the String. The size comes from the document, so
+        // an ALLOCA_N of it is an unbounded stack allocation, and the heap the
+        // String already needs costs nothing extra.
+        VALUE v = rb_str_new(0, (long)str_size);
 
-        from_base64(text, (uchar *)str);
-        v = rb_str_new(str, str_size);
+        from_base64(text, (uchar *)RSTRING_PTR(v), str_size + 1);
         if (0 != pi->options->rb_enc) {
             rb_enc_associate(v, pi->options->rb_enc);
         }
         if (0 != pi->circ_array) {
-            circ_array_set(pi->circ_array, v, (unsigned long)h->obj);
+            // h->obj is still Qundef; add_element() parked the id in pi->id.
+            circ_array_set(pi->circ_array, v, pi->id);
         }
         h->obj = v;
         break;
     }
     case Symbol64Code: {
         unsigned long str_size = b64_orig_size(text);
-        char         *str      = ALLOCA_N(char, str_size + 1);
+        VALUE         v        = rb_str_new(0, (long)str_size);
+        char         *str      = RSTRING_PTR(v);
 
-        from_base64(text, (uchar *)str);
+        from_base64(text, (uchar *)str, str_size + 1);
         h->obj = ox_sym_intern(str, strlen(str), NULL);
+        RB_GC_GUARD(v);
         break;
     }
-    case RegexpCode:
+    case RegexpCode: {
+        VALUE re;
+
         if ('/' == *text) {
-            h->obj = parse_regexp(text);
+            re = parse_regexp(text, pi);
         } else {
             unsigned long str_size = b64_orig_size(text);
-            char         *str      = ALLOCA_N(char, str_size + 1);
+            VALUE         v        = rb_str_new(0, (long)str_size);
+            char         *str      = RSTRING_PTR(v);
 
-            from_base64(text, (uchar *)str);
-            h->obj = parse_regexp(str);
+            from_base64(text, (uchar *)str, str_size + 1);
+            re = parse_regexp(str, pi);
+            RB_GC_GUARD(v);
+        }
+        if (Qundef == re) {
+            return;
         }
+        h->obj = re;
         break;
+    }
     case BignumCode: h->obj = rb_cstr_to_inum(text, 10, 1); break;
     case BigDecimalCode: h->obj = rb_funcall(rb_cObject, ox_bigdecimal_id, 1, rb_str_new2(text)); break;
-    default: h->obj = Qnil; break;
+    default: {
+        // The rest are containers add_element() built. Replacing one with Qnil
+        // left end_element() reading the nil back as an Array or a Struct.
+        // skip_off delivers the indentation between children here.
+        size_t i;
+
+        for (i = 0; i < len; i++) {
+            if (' ' != text[i] && '\t' != text[i] && '\n' != text[i] && '\r' != text[i]) {
+                set_error(&pi->err, "Unexpected text", pi->str, pi->s);
+                return;
+            }
+        }
+        break;
+    }
     }
 }
 
@@ -424,6 +536,8 @@ static void add_element(PInfo pi, const char *ename, Attr attrs, int hasChildren
     Attr          a;
     Helper        h;
     unsigned long id;
+    bool          index;
+    ID            var;
 
     if (TRACE <= pi->options->trace) {
         char  buf[1024];
@@ -454,7 +568,9 @@ static void add_element(PInfo pi, const char *ename, Attr attrs, int hasChildren
         set_error(&pi->err, "Invalid element name", pi->str, pi->s);
         return;
     }
-    h = helper_stack_push(&pi->helpers, get_var_sym_from_attrs(attrs, (void *)pi->options->rb_enc), Qundef, *ename);
+    var      = get_var_sym_from_attrs(attrs, (void *)pi->options->rb_enc, &index);
+    h        = helper_stack_push(&pi->helpers, var, Qundef, *ename);
+    h->index = index;
     switch (h->type) {
     case NilClassCode: h->obj = Qnil; break;
     case TrueClassCode: h->obj = Qtrue; break;
@@ -527,7 +643,12 @@ static void add_element(PInfo pi, const char *ename, Attr attrs, int hasChildren
         }
         break;
     case StructCode:
-        h->obj = get_struct_from_attrs(attrs);
+        // Returns Qundef with no c attribute and, unlike the helpers above, does
+        // not set the error itself. The Qundef reached rb_struct_aset().
+        if (Qundef == (h->obj = get_struct_from_attrs(attrs))) {
+            set_error(&pi->err, "Invalid element for object mode", pi->str, pi->s);
+            return;
+        }
         if (0 != pi->circ_array) {
             circ_array_set(pi->circ_array, h->obj, get_id_from_attrs(pi, attrs));
         }
@@ -594,7 +715,9 @@ static void end_element(PInfo pi, const char *ename) {
             case ExceptionCode:
             case ObjectCode:
                 if (Qnil != ph->obj) {
-                    if (0 == h->var || NULL == rb_id2name(h->var)) {
+                    // An index is a valid ID too, so a numeric a attribute set an
+                    // instance variable named whatever was interned in that slot.
+                    if (0 == h->var || h->index || NULL == rb_id2name(h->var)) {
                         set_error(&pi->err, "Invalid element for object mode", pi->str, pi->s);
                         return;
                     }
@@ -606,7 +729,9 @@ static void end_element(PInfo pi, const char *ename) {
                 }
                 break;
             case StructCode:
-                if (0 == h->var) {
+                // An ID landed in rb_struct_aset() as a Fixnum, so a name picked
+                // whichever member that number happened to be.
+                if (0 == h->var || !h->index) {
                     set_error(&pi->err, "Invalid element for object mode", pi->str, pi->s);
                     return;
                 }
@@ -614,9 +739,14 @@ static void end_element(PInfo pi, const char *ename) {
                 break;
             case HashCode:
                 // put back h
-                helper_stack_push(&pi->helpers, h->var, h->obj, KeyCode);
+                helper_stack_push(&pi->helpers, h->var, h->obj, KeyCode)->index = h->index;
                 break;
             case RangeCode:
+                // An index can equal one of these IDs, so turn it away first.
+                if (h->index) {
+                    set_error(&pi->err, "Invalid range attribute", pi->str, pi->s);
+                    return;
+                }
                 if (ox_beg_id == h->var) {
                     rb_ary_store(ph->obj, 0, h->obj);
                 } else if (ox_end_id == h->var) {
@@ -673,7 +803,7 @@ static void end_element(PInfo pi, const char *ename) {
         }
     }
     if (0 != pi->circ_array && helper_stack_empty(&pi->helpers)) {
-        circ_array_free(pi->circ_array);
+        ox_circ_array_free(pi->circ_array);
         pi->circ_array = 0;
     }
     if (DEBUG <= pi->options->trace) {
@@ -682,17 +812,23 @@ static void end_element(PInfo pi, const char *ename) {
 }
 
 static VALUE parse_double_time(const char *text, VALUE clas) {
-    long        v   = 0;
+    time_t      v   = 0;
     long        v2  = 0;
     const char *dot = 0;
     char        c;
+    bool        neg = false;
 
+    // A time before the epoch is written as a sign followed by the magnitude.
+    if ('-' == *text) {
+        neg = true;
+        text++;
+    }
     for (; '.' != *text; text++) {
         c = *text;
         if (c < '0' || '9' < c) {
             return Qnil;
         }
-        v = 10 * v + (long)(c - '0');
+        v = 10 * v + (time_t)(c - '0');
     }
     dot = text++;
     for (; '\0' != *text && text - dot <= 6; text++) {
@@ -705,6 +841,17 @@ static VALUE parse_double_time(const char *text, VALUE clas) {
     for (; text - dot <= 9; text++) {
         v2 *= 10;
     }
+    if (neg) {
+        // rb_time_nano_new() wants a non negative nanosecond count, so the
+        // fraction goes back into the second count the way dump_time_thin()
+        // took it out.
+        if (0 == v2) {
+            v = -v;
+        } else {
+            v  = -v - 1;
+            v2 = 1000000000L - v2;
+        }
+    }
     return rb_time_nano_new(v, v2);
 }
 
@@ -731,7 +878,9 @@ static VALUE parse_xsd_time(const char *text, VALUE clas) {
                           {2, '\0', '\0'},
                           {0, '\0', '\0'}};
     Tp         tp      = tpa;
-    struct tm  tm;
+    long       nsec    = 0;
+    long       offset;
+    bool       neg = false;
 
     for (; 0 != tp->cnt; tp++) {
         for (i = tp->cnt, v = 0; 0 < i; text++, i--) {
@@ -744,19 +893,30 @@ static VALUE parse_xsd_time(const char *text, VALUE clas) {
             }
             v = 10 * v + (long)(c - '0');
         }
+        // The fraction is the only field terminated by the offset sign, and the
+        // sign is the only place the offset's direction is written down.
+        if ('+' == tp->end) {
+            nsec = v;
+            for (; 0 < i; i--) {
+                nsec *= 10;
+            }
+            neg = ('-' == *text);
+        }
         c = *text++;
         if (tp->end != c && tp->alt != c) {
             return Qnil;
         }
         *cp++ = v;
     }
-    tm.tm_year = (int)cargs[0] - 1900;
-    tm.tm_mon  = (int)cargs[1] - 1;
-    tm.tm_mday = (int)cargs[2];
-    tm.tm_hour = (int)cargs[3];
-    tm.tm_min  = (int)cargs[4];
-    tm.tm_sec  = (int)cargs[5];
-    return rb_time_nano_new(mktime(&tm), cargs[6]);
+    offset = cargs[7] * 3600 + cargs[8] * 60;
+    if (neg) {
+        offset = -offset;
+    }
+    // mktime() would read the wall clock as local time and throw the offset
+    // away, and returns -1 for everything before the epoch on Windows.
+    return rb_time_nano_new(
+        (time_t)(ox_epoch_from_civil(cargs[0], cargs[1], cargs[2], cargs[3], cargs[4], cargs[5]) - offset),
+        nsec);
 }
 
 // debug functions
@@ -791,7 +951,7 @@ static void debug_stack(PInfo pi, const char *comment) {
                 clas = rb_class2name(c);
             }
             if (0 != h->var) {
-                if (HashCode == h->type) {
+                if (h->index) {
                     VALUE v;
 
                     v   = rb_String(h->var);