* Add fix for CVE-2013-0269, json vulnerability.

* Add comments to patches related to mdoc markup.

Bump PKGREVISION.

15 files changed, 354 insertions, 13 deletions

diff --git a/lang/ruby193-base/Makefile b/lang/ruby193-base/Makefile
index 340324ce6b2..18f2f725a8a 100644
--- a/lang/ruby193-base/Makefile
+++ b/lang/ruby193-base/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.24 2013/02/06 23:22:39 jperkin Exp $
+# $NetBSD: Makefile,v 1.25 2013/02/12 13:03:08 taca Exp $
 #
 
 DISTNAME=	${RUBY_DISTNAME}
 PKGNAME=	${RUBY_PKGPREFIX}-base-${RUBY_VERSION_FULL}
-PKGREVISION=	1
+PKGREVISION=	2
 CATEGORIES=	lang ruby
 MASTER_SITES=	${MASTER_SITE_RUBY}
 
diff --git a/lang/ruby193-base/PLIST b/lang/ruby193-base/PLIST
index 1281be5a227..89a3eb7a375 100644
--- a/lang/ruby193-base/PLIST
+++ b/lang/ruby193-base/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.6 2013/02/06 15:48:31 taca Exp $
+@comment $NetBSD: PLIST,v 1.7 2013/02/12 13:03:08 taca Exp $
 bin/erb${RUBY_VER}
 bin/gem${RUBY_VER}
 bin/irb${RUBY_VER}
@@ -774,7 +774,7 @@ ${GEM_HOME}/gems/rdoc-3.9.5/bin/rdoc${RUBY_VER}
 ${GEM_HOME}/gems/rdoc-3.9.5/bin/ri${RUBY_VER}
 ${GEM_HOME}/specifications/bigdecimal-1.1.0.gemspec
 ${GEM_HOME}/specifications/io-console-0.3.gemspec
-${GEM_HOME}/specifications/json-1.5.4.gemspec
+${GEM_HOME}/specifications/json-1.5.5.gemspec
 ${GEM_HOME}/specifications/minitest-2.5.1.gemspec
 ${GEM_HOME}/specifications/rake-0.9.2.2.gemspec
 ${GEM_HOME}/specifications/rdoc-3.9.5.gemspec
diff --git a/lang/ruby193-base/distinfo b/lang/ruby193-base/distinfo
index 5b5495b94ef..64192c8afa7 100644
--- a/lang/ruby193-base/distinfo
+++ b/lang/ruby193-base/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2013/02/06 15:48:31 taca Exp $
+$NetBSD: distinfo,v 1.17 2013/02/12 13:03:09 taca Exp $
 
 SHA1 (ruby-1.9.3-p385.tar.bz2) = 54e8d08103e915e2b07dcfcea88ab7fc42d40b0a
 RMD160 (ruby-1.9.3-p385.tar.bz2) = b2fbe56de1295659aa54c0a2d9f77a1212f62a02
@@ -6,6 +6,11 @@ Size (ruby-1.9.3-p385.tar.bz2) = 10021486 bytes
 SHA1 (patch-configure) = e72a5414a9e706962692e645173c5b47ddb41932
 SHA1 (patch-configure.in) = 0996411e3125a298c770f4eead0edbc530a0a584
 SHA1 (patch-defs_default__gems) = fb24111736f1a76a05e853aa068024dbdd24e5a5
+SHA1 (patch-ext_json_lib_json_add_core.rb) = d5dc99b3ae708a3866bd7dc67d232f99f91ec6ff
+SHA1 (patch-ext_json_lib_json_common.rb) = 69aa40256393b75bf246f53302766ebfbe367e30
+SHA1 (patch-ext_json_lib_json_version.rb) = 868cb21e42ded3b891fb09de4d767f7ecc491b55
+SHA1 (patch-ext_json_parser_parser.c) = f17a3c3e65c9783db5e530058ee1c5e5ca1f28a3
+SHA1 (patch-ext_json_parser_parser.rl) = a64baf9d268c5161a061e29a0692583b599dd237
 SHA1 (patch-lib_rdoc_ri_driver.rb) = acb4cb022893eb8dea2adf7564f5e5e1a0f1e9c8
 SHA1 (patch-lib_rubygems.rb) = 2aed4990a868dc92668a78da7bcff2050ff3dd66
 SHA1 (patch-lib_rubygems_commands_install__command.rb) = ff637f39f3fd76b7550fd7f8c32fe303eec6f8c3
@@ -21,10 +26,13 @@ SHA1 (patch-lib_rubygems_installer.rb) = cec82bd0c5255a2a23799273c7a2835e2bef7e3
 SHA1 (patch-lib_rubygems_specification.rb) = bc1f844153d00623349ea2d703a979001c9986ec
 SHA1 (patch-lib_rubygems_uninstaller.rb) = bde19710968f80e56760288d09870a08f3a4ec52
 SHA1 (patch-lib_rubygems_version.rb) = 3ec26651ba8f2e6bbd4527e8c0a2f5944833264f
-SHA1 (patch-man_erb.1) = 210aa77328689868162566bf01e3ba261dec0c2b
-SHA1 (patch-man_irb.1) = 899fdd973bb2491cf7f606ee68ffa6cdbe42f725
-SHA1 (patch-man_ri.1) = 3283b897b8ed36933ccecce158bcb3463d667aff
-SHA1 (patch-man_ruby.1) = 8c9edcdc72b674f8f4ef5b35e17aa0a6c38245e7
+SHA1 (patch-man_erb.1) = a8f69ebb02b4d5e1c80b270a3d683c23d8dfbcf1
+SHA1 (patch-man_irb.1) = 58fcccbb5f5f76450715cbf246a018af58d9b57e
+SHA1 (patch-man_ri.1) = 25d82d08a9eb74ccc1cbbc1fc324d23f1a56ed64
+SHA1 (patch-man_ruby.1) = 43c638a38bed8257f33d8f5a491acd77a18032b7
+SHA1 (patch-test_json_test__json.rb) = 174f8664ad20bdcdcd7987c4c5234bcfa29e0df4
+SHA1 (patch-test_json_test__json__addition.rb) = 266421cf4f7b844bf354b9bf11cec371d9996e3f
+SHA1 (patch-test_json_test__json__string__matching.rb) = e2015f62e21607068e111ade3323207ae65093c8
 SHA1 (patch-test_rubygems_test__gem.rb) = fe8b8e436b255595122d2a01462ba0a686575f24
 SHA1 (patch-tool_rbinstall.rb) = f0497085a09b31145f57028b30e335b09acabcff
 SHA1 (patch-vsnprintf.c) = 7bb4ca07381536717518143ef7803634168ca9fa
diff --git a/lang/ruby193-base/patches/patch-ext_json_lib_json_add_core.rb b/lang/ruby193-base/patches/patch-ext_json_lib_json_add_core.rb
new file mode 100644
index 00000000000..2a02c43a17f
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-ext_json_lib_json_add_core.rb
@@ -0,0 +1,32 @@
+$NetBSD: patch-ext_json_lib_json_add_core.rb,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- ext/json/lib/json/add/core.rb.orig	2011-08-31 07:02:52.000000000 +0000
++++ ext/json/lib/json/add/core.rb
+@@ -36,8 +36,8 @@ class Time
+     if usec = object.delete('u') # used to be tv_usec -> tv_nsec
+       object['n'] = usec * 1000
+     end
+-    if respond_to?(:tv_nsec)
+-      at(*object.values_at('s', 'n'))
++    if instance_methods.include?(:tv_nsec)
++      at(object['s'], Rational(object['n'], 1000))
+     else
+       at(object['s'], object['n'] / 1000)
+     end
+@@ -46,10 +46,13 @@ class Time
+   # Returns a hash, that will be turned into a JSON object and represent this
+   # object.
+   def as_json(*)
++    nanoseconds = [ tv_usec * 1000 ]
++    respond_to?(:tv_nsec) and nanoseconds << tv_nsec
++    nanoseconds = nanoseconds.max
+     {
+       JSON.create_id => self.class.name,
+       's'            => tv_sec,
+-      'n'            => respond_to?(:tv_nsec) ? tv_nsec : tv_usec * 1000
++      'n'            => nanoseconds,
+     }
+   end
+ 
diff --git a/lang/ruby193-base/patches/patch-ext_json_lib_json_common.rb b/lang/ruby193-base/patches/patch-ext_json_lib_json_common.rb
new file mode 100644
index 00000000000..262f3325b36
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-ext_json_lib_json_common.rb
@@ -0,0 +1,54 @@
+$NetBSD: patch-ext_json_lib_json_common.rb,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- ext/json/lib/json/common.rb.orig	2011-08-30 02:25:32.000000000 +0000
++++ ext/json/lib/json/common.rb
+@@ -141,7 +141,7 @@ module JSON
+   #   the default.
+   # * *create_additions*: If set to false, the Parser doesn't create
+   #   additions even if a matching class and create_id was found. This option
+-  #   defaults to true.
++  #   defaults to false.
+   # * *object_class*: Defaults to Hash
+   # * *array_class*: Defaults to Array
+   def parse(source, opts = {})
+@@ -162,7 +162,7 @@ module JSON
+   #   to true.
+   # * *create_additions*: If set to false, the Parser doesn't create
+   #   additions even if a matching class and create_id was found. This option
+-  #   defaults to true.
++  #   defaults to false.
+   def parse!(source, opts = {})
+     opts = {
+       :max_nesting  => false,
+@@ -287,11 +287,18 @@ module JSON
+   # Load a ruby data structure from a JSON _source_ and return it. A source can
+   # either be a string-like object, an IO-like object, or an object responding
+   # to the read method. If _proc_ was given, it will be called with any nested
+-  # Ruby object as an argument recursively in depth first order.
++  # Ruby object as an argument recursively in depth first order. To modify the
++  # default options pass in the optional _options_ argument as well.
+   #
+   # This method is part of the implementation of the load/dump interface of
+   # Marshal and YAML.
+-  def load(source, proc = nil)
++  def load(source, proc = nil, options = {})
++    load_default_options = {
++      :max_nesting      => false,
++      :allow_nan        => true,
++      :create_additions => false
++    }
++    opts = load_default_options.merge options
+     if source.respond_to? :to_str
+       source = source.to_str
+     elsif source.respond_to? :to_io
+@@ -299,7 +306,7 @@ module JSON
+     else
+       source = source.read
+     end
+-    result = parse(source, :max_nesting => false, :allow_nan => true)
++    result = parse(source, opts)
+     recurse_proc(result, &proc) if proc
+     result
+   end
diff --git a/lang/ruby193-base/patches/patch-ext_json_lib_json_version.rb b/lang/ruby193-base/patches/patch-ext_json_lib_json_version.rb
new file mode 100644
index 00000000000..77d58cf2394
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-ext_json_lib_json_version.rb
@@ -0,0 +1,14 @@
+$NetBSD: patch-ext_json_lib_json_version.rb,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- ext/json/lib/json/version.rb.orig	2011-07-10 08:01:04.000000000 +0000
++++ ext/json/lib/json/version.rb
+@@ -1,6 +1,6 @@
+ module JSON
+   # JSON version
+-  VERSION         = '1.5.4'
++  VERSION         = '1.5.5'
+   VERSION_ARRAY   = VERSION.split(/\./).map { |x| x.to_i } # :nodoc:
+   VERSION_MAJOR   = VERSION_ARRAY[0] # :nodoc:
+   VERSION_MINOR   = VERSION_ARRAY[1] # :nodoc:
diff --git a/lang/ruby193-base/patches/patch-ext_json_parser_parser.c b/lang/ruby193-base/patches/patch-ext_json_parser_parser.c
new file mode 100644
index 00000000000..c0a3de52056
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-ext_json_parser_parser.c
@@ -0,0 +1,15 @@
+$NetBSD: patch-ext_json_parser_parser.c,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- ext/json/parser/parser.c.orig	2012-04-16 11:15:31.000000000 +0000
++++ ext/json/parser/parser.c
+@@ -1676,7 +1676,7 @@ static VALUE cParser_initialize(int argc
+             if (option_given_p(opts, tmp)) {
+                 json->create_additions = RTEST(rb_hash_aref(opts, tmp));
+             } else {
+-                json->create_additions = 1;
++                json->create_additions = 0;
+             }
+             tmp = ID2SYM(i_create_id);
+             if (option_given_p(opts, tmp)) {
diff --git a/lang/ruby193-base/patches/patch-ext_json_parser_parser.rl b/lang/ruby193-base/patches/patch-ext_json_parser_parser.rl
new file mode 100644
index 00000000000..54e827b69c7
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-ext_json_parser_parser.rl
@@ -0,0 +1,25 @@
+$NetBSD: patch-ext_json_parser_parser.rl,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- ext/json/parser/parser.rl.orig	2012-04-16 11:15:31.000000000 +0000
++++ ext/json/parser/parser.rl
+@@ -607,6 +607,9 @@ static VALUE convert_encoding(VALUE sour
+  *   defaults to true.
+  * * *object_class*: Defaults to Hash
+  * * *array_class*: Defaults to Array
++ * * *quirks_mode*: Enables quirks_mode for parser, that is for example
++ *   parsing single JSON values instead of documents is possible.
++ *
+  */
+ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
+ {
+@@ -657,7 +660,7 @@ static VALUE cParser_initialize(int argc
+             if (option_given_p(opts, tmp)) {
+                 json->create_additions = RTEST(rb_hash_aref(opts, tmp));
+             } else {
+-                json->create_additions = 1;
++                json->create_additions = 0;
+             }
+             tmp = ID2SYM(i_create_id);
+             if (option_given_p(opts, tmp)) {
diff --git a/lang/ruby193-base/patches/patch-man_erb.1 b/lang/ruby193-base/patches/patch-man_erb.1
index af34a0e1f18..d3ca14689c8 100644
--- a/lang/ruby193-base/patches/patch-man_erb.1
+++ b/lang/ruby193-base/patches/patch-man_erb.1
@@ -1,4 +1,6 @@
-$NetBSD: patch-man_erb.1,v 1.1 2012/01/24 20:42:42 joerg Exp $
+$NetBSD: patch-man_erb.1,v 1.2 2013/02/12 13:03:09 taca Exp $
+
+Fix mdoc markup.
 
 --- man/erb.1.orig	2012-01-24 20:07:01.000000000 +0000
 +++ man/erb.1
diff --git a/lang/ruby193-base/patches/patch-man_irb.1 b/lang/ruby193-base/patches/patch-man_irb.1
index dd124ce1b7b..6c518ef46bd 100644
--- a/lang/ruby193-base/patches/patch-man_irb.1
+++ b/lang/ruby193-base/patches/patch-man_irb.1
@@ -1,4 +1,6 @@
-$NetBSD: patch-man_irb.1,v 1.1 2012/01/24 20:42:42 joerg Exp $
+$NetBSD: patch-man_irb.1,v 1.2 2013/02/12 13:03:09 taca Exp $
+
+Fix mdoc markup.
 
 --- man/irb.1.orig	2012-01-24 20:07:49.000000000 +0000
 +++ man/irb.1
diff --git a/lang/ruby193-base/patches/patch-man_ri.1 b/lang/ruby193-base/patches/patch-man_ri.1
index 380f0936dfa..9878a21a0a3 100644
--- a/lang/ruby193-base/patches/patch-man_ri.1
+++ b/lang/ruby193-base/patches/patch-man_ri.1
@@ -1,4 +1,6 @@
-$NetBSD: patch-man_ri.1,v 1.1 2012/01/24 20:42:43 joerg Exp $
+$NetBSD: patch-man_ri.1,v 1.2 2013/02/12 13:03:09 taca Exp $
+
+Fix mdoc markup.
 
 --- man/ri.1.orig	2012-01-24 20:08:14.000000000 +0000
 +++ man/ri.1
diff --git a/lang/ruby193-base/patches/patch-man_ruby.1 b/lang/ruby193-base/patches/patch-man_ruby.1
index 8be12bc596c..b92260a6328 100644
--- a/lang/ruby193-base/patches/patch-man_ruby.1
+++ b/lang/ruby193-base/patches/patch-man_ruby.1
@@ -1,4 +1,6 @@
-$NetBSD: patch-man_ruby.1,v 1.1 2012/01/24 20:42:43 joerg Exp $
+$NetBSD: patch-man_ruby.1,v 1.2 2013/02/12 13:03:09 taca Exp $
+
+Fix mdoc markup.
 
 --- man/ruby.1.orig	2012-01-24 20:08:36.000000000 +0000
 +++ man/ruby.1
diff --git a/lang/ruby193-base/patches/patch-test_json_test__json.rb b/lang/ruby193-base/patches/patch-test_json_test__json.rb
new file mode 100644
index 00000000000..b3d5d710b95
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-test_json_test__json.rb
@@ -0,0 +1,55 @@
+$NetBSD: patch-test_json_test__json.rb,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- test/json/test_json.rb.orig	2011-08-30 02:25:32.000000000 +0000
++++ test/json/test_json.rb
+@@ -4,6 +4,7 @@
+ require 'test/unit'
+ require File.join(File.dirname(__FILE__), 'setup_variant')
+ require 'stringio'
++require 'tempfile'
+ 
+ unless Array.method_defined?(:permutation)
+   begin
+@@ -263,12 +264,12 @@ class TC_JSON < Test::Unit::TestCase
+   def test_generation_of_core_subclasses_with_new_to_json
+     obj = SubHash2["foo" => SubHash2["bar" => true]]
+     obj_json = JSON(obj)
+-    obj_again = JSON(obj_json)
++    obj_again = JSON.parse(obj_json, :create_additions => true)
+     assert_kind_of SubHash2, obj_again
+     assert_kind_of SubHash2, obj_again['foo']
+     assert obj_again['foo']['bar']
+     assert_equal obj, obj_again
+-    assert_equal ["foo"], JSON(JSON(SubArray2["foo"]))
++    assert_equal ["foo"], JSON(JSON(SubArray2["foo"]), :create_additions => true)
+   end
+ 
+   def test_generation_of_core_subclasses_with_default_to_json
+@@ -414,6 +415,25 @@ EOT
+       JSON.parse('{"foo":"bar", "baz":"quux"}', :symbolize_names => true))
+   end
+ 
++  def test_load
++    assert_equal @hash, JSON.load(@json)
++    tempfile = Tempfile.open('json')
++    tempfile.write @json
++    tempfile.rewind
++    assert_equal @hash, JSON.load(tempfile)
++    stringio = StringIO.new(@json)
++    stringio.rewind
++    assert_equal @hash, JSON.load(stringio)
++    assert_raise(NoMethodError) { JSON.load(nil) }
++    assert_raise(JSON::ParserError) {JSON.load('') }
++  end
++
++  def test_load_with_options
++    small_hash  = JSON("foo" => 'bar')
++    symbol_hash = { :foo => 'bar' }
++    assert_equal symbol_hash, JSON.load(small_hash, nil, :symbolize_names => true)
++  end
++
+   def test_load_dump
+     too_deep = '[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]]]]]'
+     assert_equal too_deep, JSON.dump(eval(too_deep))
diff --git a/lang/ruby193-base/patches/patch-test_json_test__json__addition.rb b/lang/ruby193-base/patches/patch-test_json_test__json__addition.rb
new file mode 100644
index 00000000000..eed25b22059
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-test_json_test__json__addition.rb
@@ -0,0 +1,104 @@
+$NetBSD: patch-test_json_test__json__addition.rb,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- test/json/test_json_addition.rb.orig	2011-09-01 00:25:52.000000000 +0000
++++ test/json/test_json_addition.rb
+@@ -69,11 +69,19 @@ class TC_JSONAddition < Test::Unit::Test
+     a = A.new(666)
+     assert A.json_creatable?
+     json = generate(a)
+-    a_again = JSON.parse(json)
++    a_again = JSON.parse(json, :create_additions => true)
+     assert_kind_of a.class, a_again
+     assert_equal a, a_again
+   end
+ 
++  def test_extended_json_default
++    a = A.new(666)
++    assert A.json_creatable?
++    json = generate(a)
++    a_hash = JSON.parse(json)
++    assert_kind_of Hash, a_hash
++  end
++
+   def test_extended_json_disabled
+     a = A.new(666)
+     assert A.json_creatable?
+@@ -100,7 +108,7 @@ class TC_JSONAddition < Test::Unit::Test
+     c = C.new
+     assert !C.json_creatable?
+     json = generate(c)
+-    assert_raises(ArgumentError, NameError) { JSON.parse(json) }
++    assert_raises(ArgumentError, NameError) { JSON.parse(json, :create_additions => true) }
+   end
+ 
+   def test_raw_strings
+@@ -118,7 +126,7 @@ class TC_JSONAddition < Test::Unit::Test
+     assert_match(/\A\{.*\}\Z/, json)
+     assert_match(/"json_class":"String"/, json)
+     assert_match(/"raw":\[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255\]/, json)
+-    raw_again = JSON.parse(json)
++    raw_again = JSON.parse(json, :create_additions => true)
+     assert_equal raw, raw_again
+   end
+ 
+@@ -126,17 +134,17 @@ class TC_JSONAddition < Test::Unit::Test
+ 
+   def test_core
+     t = Time.now
+-    assert_equal t.inspect, JSON(JSON(t)).inspect
++    assert_equal t, JSON(JSON(t), :create_additions => true)
+     d = Date.today
+-    assert_equal d, JSON(JSON(d))
++    assert_equal d, JSON(JSON(d), :create_additions => true)
+     d = DateTime.civil(2007, 6, 14, 14, 57, 10, Rational(1, 12), 2299161)
+-    assert_equal d, JSON(JSON(d))
+-    assert_equal 1..10, JSON(JSON(1..10))
+-    assert_equal 1...10, JSON(JSON(1...10))
+-    assert_equal "a".."c", JSON(JSON("a".."c"))
+-    assert_equal "a"..."c", JSON(JSON("a"..."c"))
++    assert_equal d, JSON(JSON(d), :create_additions => true)
++    assert_equal 1..10, JSON(JSON(1..10), :create_additions => true)
++    assert_equal 1...10, JSON(JSON(1...10), :create_additions => true)
++    assert_equal "a".."c", JSON(JSON("a".."c"), :create_additions => true)
++    assert_equal "a"..."c", JSON(JSON("a"..."c"), :create_additions => true)
+     s = MyJsonStruct.new 4711, 'foot'
+-    assert_equal s, JSON(JSON(s))
++    assert_equal s, JSON(JSON(s), :create_additions => true)
+     struct = Struct.new :foo, :bar
+     s = struct.new 4711, 'foot'
+     assert_raises(JSONError) { JSON(s) }
+@@ -144,24 +152,24 @@ class TC_JSONAddition < Test::Unit::Test
+       raise TypeError, "test me"
+     rescue TypeError => e
+       e_json = JSON.generate e
+-      e_again = JSON e_json
++      e_again = JSON e_json, :create_additions => true
+       assert_kind_of TypeError, e_again
+       assert_equal e.message, e_again.message
+       assert_equal e.backtrace, e_again.backtrace
+     end
+-    assert_equal(/foo/, JSON(JSON(/foo/)))
+-    assert_equal(/foo/i, JSON(JSON(/foo/i)))
++    assert_equal(/foo/, JSON(JSON(/foo/), :create_additions => true))
++    assert_equal(/foo/i, JSON(JSON(/foo/i), :create_additions => true))
+   end
+ 
+   def test_utc_datetime
+     now = Time.now
+-    d = DateTime.parse(now.to_s)                    # usual case
+-    assert_equal d, JSON.parse(d.to_json)
++    d = DateTime.parse(now.to_s, :create_additions => true)                    # usual case
++    assert_equal d, JSON.parse(d.to_json, :create_additions => true)
+     d = DateTime.parse(now.utc.to_s)                # of = 0
+-    assert_equal d, JSON.parse(d.to_json)
++    assert_equal d, JSON.parse(d.to_json, :create_additions => true)
+     d = DateTime.civil(2008, 6, 17, 11, 48, 32, Rational(1,24))
+-    assert_equal d, JSON.parse(d.to_json)
++    assert_equal d, JSON.parse(d.to_json, :create_additions => true)
+     d = DateTime.civil(2008, 6, 17, 11, 48, 32, Rational(12,24))
+-    assert_equal d, JSON.parse(d.to_json)
++    assert_equal d, JSON.parse(d.to_json, :create_additions => true)
+   end
+ end
diff --git a/lang/ruby193-base/patches/patch-test_json_test__json__string__matching.rb b/lang/ruby193-base/patches/patch-test_json_test__json__string__matching.rb
new file mode 100644
index 00000000000..a86efdb3670
--- /dev/null
+++ b/lang/ruby193-base/patches/patch-test_json_test__json__string__matching.rb
@@ -0,0 +1,26 @@
+$NetBSD: patch-test_json_test__json__string__matching.rb,v 1.1 2013/02/12 13:03:09 taca Exp $
+
+Fix for CVE-2013-0269.
+
+--- test/json/test_json_string_matching.rb.orig	2011-07-10 08:01:04.000000000 +0000
++++ test/json/test_json_string_matching.rb
+@@ -27,14 +27,13 @@ class TestJsonStringMatching < Test::Uni
+     t = TestTime.new
+     t_json = [ t ].to_json
+     assert_equal [ t ],
+-      JSON.parse(t_json,
+-        :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\Z/ => TestTime })
++      JSON.parse(t_json, :create_additions => true,
++        :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\z/ => TestTime })
+     assert_equal [ t.strftime('%FT%T%z') ],
+-      JSON.parse(t_json,
+-        :match_string => { /\A\d{3}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\Z/ => TestTime })
++      JSON.parse(t_json, :create_additions => true,
++        :match_string => { /\A\d{3}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\z/ => TestTime })
+     assert_equal [ t.strftime('%FT%T%z') ],
+       JSON.parse(t_json,
+-        :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\Z/ => TestTime },
+-        :create_additions => false)
++        :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\z/ => TestTime })
+   end
+ end