20 files changed, 215 insertions, 77 deletions
diff --git a/lib/cgi/core.rb b/lib/cgi/core.rb
index e961b16474..d7ec8981d7 100644
--- a/lib/cgi/core.rb
+++ b/lib/cgi/core.rb
@@ -478,10 +478,12 @@ class CGI
       bufsize = 10 * 1024
       max_count = MAX_MULTIPART_COUNT
       n = 0
+      tempfiles = []
       while true
         (n += 1) < max_count or raise StandardError.new("too many parameters.")
         ## create body (StringIO or Tempfile)
         body = create_body(bufsize < content_length)
+        tempfiles << body if defined?(Tempfile) && body.kind_of?(Tempfile)
         class << body
           if method_defined?(:path)
             alias local_path path
@@ -562,6 +564,15 @@ class CGI
       raise EOFError, "bad boundary end of body part" unless boundary_end =~ /--/
       params.default = []
       params
+    rescue Exception
+      if tempfiles
+        tempfiles.each {|t|
+          if t.path
+            t.unlink
+          end
+        }
+      end
+      raise
     end # read_multipart
     private :read_multipart
     def create_body(is_large)  #:nodoc:
diff --git a/lib/drb/ssl.rb b/lib/drb/ssl.rb
index 2b6a2376ef..a680594d80 100644
--- a/lib/drb/ssl.rb
+++ b/lib/drb/ssl.rb
@@ -179,8 +179,9 @@ module DRb
       end
       begin
 	ssl = @config.accept(soc)
-      ensure
-        soc.close if $!
+      rescue Exception
+        soc.close
+        raise
       end
       self.class.new(uri, ssl, @config, true)
       rescue OpenSSL::SSL::SSLError
diff --git a/lib/gserver.rb b/lib/gserver.rb
index f6f37d3a89..4dd5ad0c08 100644
--- a/lib/gserver.rb
+++ b/lib/gserver.rb
@@ -3,7 +3,7 @@
 #
 # Author::        John W. Small
 # Documentation:: Gavin Sinclair
-# Licence::       Freeware.
+# Licence::       Ruby License
 
 require "socket"
 require "thread"
diff --git a/lib/mkmf.rb b/lib/mkmf.rb
index a7517615ff..898e4a78c9 100644
--- a/lib/mkmf.rb
+++ b/lib/mkmf.rb
@@ -300,7 +300,7 @@ end
 def xsystem command, opts = nil
   varpat = /\$\((\w+)\)|\$\{(\w+)\}/
   if varpat =~ command
-    vars = Hash.new {|h, k| h[k] = ''; ENV[k]}
+    vars = Hash.new {|h, k| h[k] = ENV[k]}
     command = command.dup
     nil while command.gsub!(varpat) {vars[$1||$2]}
   end
@@ -619,14 +619,14 @@ def try_func(func, libs, headers = nil, &b)
   try_link(<<"SRC", libs, &b) or
 #{headers}
 /*top*/
-#{MAIN_DOES_NOTHING}
 int t() { #{decltype["volatile p"]}; p = (#{decltype[]})#{func}; return 0; }
+#{MAIN_DOES_NOTHING "t"}
 SRC
   call && try_link(<<"SRC", libs, &b)
 #{headers}
 /*top*/
-#{MAIN_DOES_NOTHING}
 int t() { #{func}(); return 0; }
+#{MAIN_DOES_NOTHING "t"}
 SRC
 end
 
@@ -636,8 +636,8 @@ def try_var(var, headers = nil, &b)
   try_compile(<<"SRC", &b)
 #{headers}
 /*top*/
-#{MAIN_DOES_NOTHING}
 int t() { const volatile void *volatile p; p = &(&#{var})[0]; return 0; }
+#{MAIN_DOES_NOTHING "t"}
 SRC
 end
 
@@ -938,18 +938,31 @@ def have_header(header, preheaders = nil, &b)
 end
 
 # Returns whether or not the given +framework+ can be found on your system.
-# If found, a macro is passed as a preprocessor constant to the compiler using
-# the framework name, in uppercase, prepended with 'HAVE_FRAMEWORK_'.
+# If found, a macro is passed as a preprocessor constant to the compiler
+# using the framework name, in uppercase, prepended with +HAVE_FRAMEWORK_+.
 #
-# For example, if have_framework('Ruby') returned true, then the HAVE_FRAMEWORK_RUBY
-# preprocessor macro would be passed to the compiler.
+# For example, if <code>have_framework('Ruby')</code> returned true, then
+# the +HAVE_FRAMEWORK_RUBY+ preprocessor macro would be passed to the
+# compiler.
 #
+# If +fw+ is a pair of the framework name and its header file name
+# that header file is checked, instead of the normally used header
+# file which is named same as the framework.
 def have_framework(fw, &b)
+  if Array === fw
+    fw, header = *fw
+  else
+    header = "#{fw}.h"
+  end
   checking_for fw do
-    src = cpp_include("#{fw}/#{fw}.h") << "\n" "int main(void){return 0;}"
-    if try_link(src, opt = "-framework #{fw}", &b)
+    src = cpp_include("#{fw}/#{header}") << "\n" "int main(void){return 0;}"
+    opt = " -framework #{fw}"
+    if try_link(src, "-ObjC#{opt}", &b)
       $defs.push(format("-DHAVE_FRAMEWORK_%s", fw.tr_cpp))
-      $LDFLAGS << " " << opt
+      # TODO: non-worse way than this hack, to get rid of separating
+      # option and its argument.
+      $LDFLAGS << " -ObjC" unless /(\A|\s)-ObjC(\s|\z)/ =~ $LDFLAGS
+      $LDFLAGS << opt
       true
     else
       false
@@ -1002,8 +1015,8 @@ def have_struct_member(type, member, headers = nil, &b)
     if try_compile(<<"SRC", &b)
 #{cpp_include(headers)}
 /*top*/
-#{MAIN_DOES_NOTHING}
 int s = (char *)&((#{type}*)0)->#{member} - (char *)0;
+#{MAIN_DOES_NOTHING "s"}
 SRC
       $defs.push(format("-DHAVE_%s_%s", type.tr_cpp, member.tr_cpp))
       $defs.push(format("-DHAVE_ST_%s", member.tr_cpp)) # backward compatibility
@@ -1243,8 +1256,8 @@ def scalar_ptr_type?(type, member = nil, headers = nil, &b)
 #{cpp_include(headers)}
 /*top*/
 volatile #{type} conftestval;
-#{MAIN_DOES_NOTHING}
 int t() {return (int)(1-*(conftestval#{member ? ".#{member}" : ""}));}
+#{MAIN_DOES_NOTHING "t"}
 SRC
 end
 
@@ -1255,8 +1268,8 @@ def scalar_type?(type, member = nil, headers = nil, &b)
 #{cpp_include(headers)}
 /*top*/
 volatile #{type} conftestval;
-#{MAIN_DOES_NOTHING}
 int t() {return (int)(1-(conftestval#{member ? ".#{member}" : ""}));}
+#{MAIN_DOES_NOTHING "t"}
 SRC
 end
 
@@ -2226,6 +2239,19 @@ def mkmf_failed(path)
   end
 end
 
+def MAIN_DOES_NOTHING(*refs)
+  src = MAIN_DOES_NOTHING
+  unless refs.empty?
+    src = src.sub(/\{/) do
+      $& +
+        "\n  if (argc > 1000000) {\n" +
+        refs.map {|n|"    printf(\"%p\", &#{n});\n"}.join("") +
+        "  }\n"
+    end
+  end
+  src
+end
+
 # :startdoc:
 
 init_mkmf
@@ -2282,17 +2308,18 @@ COMPILE_CXX = config_string('COMPILE_CXX') || '$(CXX) $(INCFLAGS) $(CPPFLAGS) $(
 TRY_LINK = config_string('TRY_LINK') ||
   "$(CC) #{OUTFLAG}conftest $(INCFLAGS) $(CPPFLAGS) " \
   "$(CFLAGS) $(src) $(LIBPATH) $(LDFLAGS) $(ARCH_FLAG) $(LOCAL_LIBS) $(LIBS)"
-LINK_SO = config_string('LINK_SO') ||
+LINK_SO = (config_string('LINK_SO') || "").sub(/^$/) do
   if CONFIG["DLEXT"] == $OBJEXT
     "ld $(DLDFLAGS) -r -o $@ $(OBJS)\n"
   else
     "$(LDSHARED) #{OUTFLAG}$@ $(OBJS) " \
     "$(LIBPATH) $(DLDFLAGS) $(LOCAL_LIBS) $(LIBS)"
   end
+end
 LIBPATHFLAG = config_string('LIBPATHFLAG') || ' -L"%s"'
 RPATHFLAG = config_string('RPATHFLAG') || ''
 LIBARG = config_string('LIBARG') || '-l%s'
-MAIN_DOES_NOTHING = config_string('MAIN_DOES_NOTHING') || 'int main() {return 0;}'
+MAIN_DOES_NOTHING = config_string('MAIN_DOES_NOTHING') || "int main(int argc, char **argv)\n{\n  return 0;\n}"
 UNIVERSAL_INTS = config_string('UNIVERSAL_INTS') {|s| Shellwords.shellwords(s)} ||
   %w[int short long long\ long]
 
diff --git a/lib/net/http.rb b/lib/net/http.rb
index fd8c802935..67de15cd27 100644
--- a/lib/net/http.rb
+++ b/lib/net/http.rb
@@ -623,13 +623,13 @@ module Net   #:nodoc:
     # Number of seconds to wait for the connection to open. Any number
     # may be used, including Floats for fractional seconds. If the HTTP
     # object cannot open a connection in this many seconds, it raises a
-    # TimeoutError exception.
+    # TimeoutError exception. The default value is +nil+.
     attr_accessor :open_timeout
 
     # Number of seconds to wait for one block to be read (via one read(2)
     # call). Any number may be used, including Floats for fractional
     # seconds. If the HTTP object cannot read data in this many seconds,
-    # it raises a TimeoutError exception.
+    # it raises a TimeoutError exception. The default value is 60 seconds.
     attr_reader :read_timeout
 
     # Setter for the read_timeout attribute.
@@ -638,8 +638,9 @@ module Net   #:nodoc:
       @read_timeout = sec
     end
 
-    # Seconds to wait for 100 Continue response.  If the HTTP object does not
-    # receive a response in this many seconds it sends the request body.
+    # Seconds to wait for 100 Continue response. If the HTTP object does not
+    # receive a response in this many seconds it sends the request body. The
+    # default value is +nil+.
     attr_reader :continue_timeout
 
     # Setter for the continue_timeout attribute.
@@ -1947,7 +1948,7 @@ module Net   #:nodoc:
       wait_for_continue sock, ver if sock.continue_timeout
       if chunked?
         while s = f.read(1024)
-          sock.write(sprintf("%x\r\n", s.length) << s << "\r\n")
+          sock.write(sprintf("%x\r\n", s.bytesize) << s << "\r\n")
         end
         sock.write "0\r\n\r\n"
       else
diff --git a/lib/net/imap.rb b/lib/net/imap.rb
index e0815a1892..df9ee8ce1e 100644
--- a/lib/net/imap.rb
+++ b/lib/net/imap.rb
@@ -1725,7 +1725,7 @@ module Net
     # rights:: The access rights the indicated user has to the
     #          mailbox.
     #
-    MailboxACLItem = Struct.new(:user, :rights)
+    MailboxACLItem = Struct.new(:user, :rights, :mailbox)
 
     # Net::IMAP::StatusData represents contents of the STATUS response.
     #
@@ -2722,6 +2722,7 @@ module Net
         token = match(T_ATOM)
         name = token.value.upcase
         match(T_SPACE)
+        mailbox = astring
         data = []
         token = lookahead
         if token.symbol == T_SPACE
@@ -2737,8 +2738,7 @@ module Net
             user = astring
             match(T_SPACE)
             rights = astring
-            ##XXX data.push([user, rights])
-            data.push(MailboxACLItem.new(user, rights))
+            data.push(MailboxACLItem.new(user, rights, mailbox))
           end
         end
         return UntaggedResponse.new(name, data, @str)
@@ -2869,6 +2869,7 @@ module Net
             break
           when T_SPACE
             shift_token
+            next
           end
           data.push(atom.upcase)
         end
diff --git a/lib/net/pop.rb b/lib/net/pop.rb
index 7e14246d16..ff2d77f72a 100644
--- a/lib/net/pop.rb
+++ b/lib/net/pop.rb
@@ -498,12 +498,12 @@ module Net
 
     # Seconds to wait until a connection is opened.
     # If the POP3 object cannot open a connection within this time,
-    # it raises a TimeoutError exception.
+    # it raises a TimeoutError exception. The default value is 30 seconds.
     attr_accessor :open_timeout
 
     # Seconds to wait until reading one block (by one read(1) call).
     # If the POP3 object cannot complete a read() within this time,
-    # it raises a TimeoutError exception.
+    # it raises a TimeoutError exception. The default value is 60 seconds.
     attr_reader :read_timeout
 
     # Set the read timeout.
diff --git a/lib/net/smtp.rb b/lib/net/smtp.rb
index 33b88f5c21..3c7af8008c 100644
--- a/lib/net/smtp.rb
+++ b/lib/net/smtp.rb
@@ -78,8 +78,9 @@ module Net
   #
   # This library does NOT provide functions to compose internet mails.
   # You must create them by yourself. If you want better mail support,
-  # try RubyMail or TMail. You can get both libraries from RAA.
-  # (http://www.ruby-lang.org/en/raa.html)
+  # try RubyMail or TMail or search for alternatives in
+  # {RubyGems.org}[https://rubygems.org/] or {The Ruby
+  # Toolbox}[https://www.ruby-toolbox.com/].
   #
   # FYI: the official documentation on internet mail is: [RFC2822] (http://www.ietf.org/rfc/rfc2822.txt).
   #
@@ -364,12 +365,12 @@ module Net
 
     # Seconds to wait while attempting to open a connection.
     # If the connection cannot be opened within this time, a
-    # TimeoutError is raised.
+    # TimeoutError is raised. The default value is 30 seconds.
     attr_accessor :open_timeout
 
     # Seconds to wait while reading one block (by one read(2) call).
     # If the read(2) call does not complete within this time, a
-    # TimeoutError is raised.
+    # TimeoutError is raised. The default value is 60 seconds.
     attr_reader :read_timeout
 
     # Set the number of seconds to wait until timing-out a read(2)
@@ -934,11 +935,11 @@ module Net
     end
 
     def critical(&block)
-      return '200 dummy reply code' if @error_occured
+      return Response.parse('200 dummy reply code') if @error_occurred
       begin
         return yield()
       rescue Exception
-        @error_occured = true
+        @error_occurred = true
         raise
       end
     end
diff --git a/lib/open-uri.rb b/lib/open-uri.rb
index 6e24b40ba5..f0cfec94e4 100644
--- a/lib/open-uri.rb
+++ b/lib/open-uri.rb
@@ -72,7 +72,7 @@ end
 # The environment variables such as http_proxy, https_proxy and ftp_proxy
 # are in effect by default.  :proxy => nil disables proxy.
 #
-#   open("http://www.ruby-lang.org/en/raa.html", :proxy => nil) {|f|
+#   open("http://www.ruby-lang.org/en/", :proxy => nil) {|f|
 #     # ...
 #   }
 #
@@ -508,8 +508,9 @@ module OpenURI
       end
     end
 
-    # returns a list of encodings in Content-Encoding field
-    # as an Array of String.
+    # Returns a list of encodings in Content-Encoding field as an array of
+    # strings.
+    #
     # The encodings are downcased for canonicalization.
     def content_encoding
       v = @meta['content-encoding']
diff --git a/lib/optparse.rb b/lib/optparse.rb
index dcb67604e2..9eec54c027 100644
--- a/lib/optparse.rb
+++ b/lib/optparse.rb
@@ -1631,15 +1631,22 @@ XXX
   decimal = '\d+(?:_\d+)*'
   binary = 'b[01]+(?:_[01]+)*'
   hex = 'x[\da-f]+(?:_[\da-f]+)*'
-  octal = "0(?:[0-7]*(?:_[0-7]+)*|#{binary}|#{hex})"
+  octal = "0(?:[0-7]+(?:_[0-7]+)*|#{binary}|#{hex})?"
   integer = "#{octal}|#{decimal}"
-  accept(Integer, %r"\A[-+]?(?:#{integer})"io) {|s,| Integer(s) if s}
+
+  accept(Integer, %r"\A[-+]?(?:#{integer})\z"io) {|s,|
+    begin
+      Integer(s)
+    rescue ArgumentError
+      raise OptionParser::InvalidArgument, s
+    end if s
+  }
 
   #
   # Float number format, and converts to Float.
   #
   float = "(?:#{decimal}(?:\\.(?:#{decimal})?)?|\\.#{decimal})(?:E[-+]?#{decimal})?"
-  floatpat = %r"\A[-+]?#{float}"io
+  floatpat = %r"\A[-+]?#{float}\z"io
   accept(Float, floatpat) {|s,| s.to_f if s}
 
   #
@@ -1647,7 +1654,7 @@ XXX
   # for float format, and Rational for rational format.
   #
   real = "[-+]?(?:#{octal}|#{float})"
-  accept(Numeric, /\A(#{real})(?:\/(#{real}))?/io) {|s, d, n|
+  accept(Numeric, /\A(#{real})(?:\/(#{real}))?\z/io) {|s, d, n|
     if n
       Rational(d, n)
     elsif s
@@ -1658,22 +1665,40 @@ XXX
   #
   # Decimal integer format, to be converted to Integer.
   #
-  DecimalInteger = /\A[-+]?#{decimal}/io
-  accept(DecimalInteger) {|s,| s.to_i if s}
+  DecimalInteger = /\A[-+]?#{decimal}\z/io
+  accept(DecimalInteger, DecimalInteger) {|s,|
+    begin
+      Integer(s)
+    rescue ArgumentError
+      raise OptionParser::InvalidArgument, s
+    end if s
+  }
 
   #
   # Ruby/C like octal/hexadecimal/binary integer format, to be converted to
   # Integer.
   #
-  OctalInteger = /\A[-+]?(?:[0-7]+(?:_[0-7]+)*|0(?:#{binary}|#{hex}))/io
-  accept(OctalInteger) {|s,| s.oct if s}
+  OctalInteger = /\A[-+]?(?:[0-7]+(?:_[0-7]+)*|0(?:#{binary}|#{hex}))\z/io
+  accept(OctalInteger, OctalInteger) {|s,|
+    begin
+      Integer(s, 8)
+    rescue ArgumentError
+      raise OptionParser::InvalidArgument, s
+    end if s
+  }
 
   #
   # Decimal integer/float number format, to be converted to Integer for
   # integer format, Float for float format.
   #
   DecimalNumeric = floatpat     # decimal integer is allowed as float also.
-  accept(DecimalNumeric) {|s,| eval(s) if s}
+  accept(DecimalNumeric, floatpat) {|s,|
+    begin
+      eval(s)
+    rescue SyntaxError
+      raise OptionParser::InvalidArgument, s
+    end if s
+  }
 
   #
   # Boolean switch, which means whether it is present or not, whether it is
diff --git a/lib/resolv.rb b/lib/resolv.rb
index 1e1889370a..9524703be4 100644
--- a/lib/resolv.rb
+++ b/lib/resolv.rb
@@ -186,7 +186,7 @@ class Resolv
         unless @initialized
           @name2addr = {}
           @addr2name = {}
-          open(@filename) {|f|
+          open(@filename, 'rb') {|f|
             f.each {|line|
               line.sub!(/#.*/, '')
               addr, hostname, *aliases = line.split(/\s+/)
@@ -500,8 +500,9 @@ class Resolv
           msg.rd = 1
           msg.add_question(candidate, typeclass)
           unless sender = senders[[candidate, nameserver, port]]
-            sender = senders[[candidate, nameserver, port]] =
-              requester.sender(msg, candidate, nameserver, port)
+            sender = requester.sender(msg, candidate, nameserver, port)
+            next if !sender
+            senders[[candidate, nameserver, port]] = sender
           end
           reply, reply_name = requester.request(sender, tout)
           case reply.rcode
@@ -707,7 +708,11 @@ class Resolv
               af = Socket::AF_INET
             end
             next if @socks_hash[bind_host]
-            sock = UDPSocket.new(af)
+            begin
+              sock = UDPSocket.new(af)
+            rescue Errno::EAFNOSUPPORT
+              next # The kernel doesn't support the address family.
+            end
             sock.do_not_reverse_lookup = true
             sock.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC) if defined? Fcntl::F_SETFD
             DNS.bind_random_port(sock, bind_host)
@@ -722,11 +727,12 @@ class Resolv
         end
 
         def sender(msg, data, host, port=Port)
+          sock = @socks_hash[host.index(':') ? "::" : "0.0.0.0"]
+          return nil if !sock
           service = [host, port]
           id = DNS.allocate_request_id(host, port)
           request = msg.encode
           request[0,2] = [id].pack('n')
-          sock = @socks_hash[host.index(':') ? "::" : "0.0.0.0"]
           return @senders[[service, id]] =
             Sender.new(request, data, sock, host, port)
         end
@@ -747,6 +753,7 @@ class Resolv
           attr_reader :data
 
           def send
+            raise "@sock is nil." if @sock.nil?
             @sock.send(@msg, 0, @host, @port)
           end
         end
@@ -790,6 +797,7 @@ class Resolv
 
         class Sender < Requester::Sender # :nodoc:
           def send
+            raise "@sock is nil." if @sock.nil?
             @sock.send(@msg, 0)
           end
           attr_reader :data
@@ -857,7 +865,7 @@ class Resolv
         nameserver = []
         search = nil
         ndots = 1
-        open(filename) {|f|
+        open(filename, 'rb') {|f|
           f.each {|line|
             line.sub!(/[#;].*/, '')
             keyword, *args = line.split(/\s+/)
@@ -1457,6 +1465,7 @@ class Resolv
         end
 
         def get_bytes(len = @limit - @index)
+          raise DecodeError.new("limit exceeded") if @limit < @index + len
           d = @data[@index, len]
           @index += len
           return d
@@ -1484,6 +1493,7 @@ class Resolv
         end
 
         def get_string
+          raise DecodeError.new("limit exceeded") if @limit <= @index
           len = @data[@index].ord
           raise DecodeError.new("limit exceeded") if @limit < @index + 1 + len
           d = @data[@index + 1, len]
@@ -1507,6 +1517,7 @@ class Resolv
           limit = @index if !limit || @index < limit
           d = []
           while true
+            raise DecodeError.new("limit exceeded") if @limit <= @index
             case @data[@index].ord
             when 0
               @index += 1
@@ -1900,10 +1911,10 @@ class Resolv
         attr_reader :strings
 
         ##
-        # Returns the first string from +strings+.
+        # Returns the concatenated string from +strings+.
 
         def data
-          @strings[0]
+          @strings.join("")
         end
 
         def encode_rdata(msg) # :nodoc:
diff --git a/lib/rexml/document.rb b/lib/rexml/document.rb
index b945a5b76c..2f9e659772 100644
--- a/lib/rexml/document.rb
+++ b/lib/rexml/document.rb
@@ -224,7 +224,7 @@ module REXML
       REXML.entity_expansion_text_limit = val
     end
 
-    # Get the entity expansion limit. By default the limit is set to 10000.
+    # Get the entity expansion limit. By default the limit is set to 10240.
     #
     # Deprecated. Use REXML.entity_expansion_text_limit instead.
     def Document::entity_expansion_text_limit
diff --git a/lib/rubygems.rb b/lib/rubygems.rb
index 7ed27461bb..480be12879 100644
--- a/lib/rubygems.rb
+++ b/lib/rubygems.rb
@@ -121,7 +121,7 @@ require "rubygems/deprecate"
 # -The RubyGems Team
 
 module Gem
-  VERSION = '1.8.23'
+  VERSION = '1.8.23.2'
 
   ##
   # Raised when RubyGems is unable to load or activate a gem.  Contains the
diff --git a/lib/rubygems/version.rb b/lib/rubygems/version.rb
index 2ced9ccdfb..86821a9f57 100644
--- a/lib/rubygems/version.rb
+++ b/lib/rubygems/version.rb
@@ -145,8 +145,8 @@ class Gem::Version
 
   include Comparable
 
-  VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*' # :nodoc:
-  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc:
+  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' # :nodoc:
+  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc:
 
   ##
   # A string representation of this Version.
diff --git a/lib/tempfile.rb b/lib/tempfile.rb
index b34251ebb6..a34e178edb 100644
--- a/lib/tempfile.rb
+++ b/lib/tempfile.rb
@@ -190,7 +190,6 @@ class Tempfile < DelegateClass(File)
   def close!
     _close
     unlink
-    ObjectSpace.undefine_finalizer(self)
   end
 
   # Unlinks (deletes) the file from the filesystem. One should always unlink
@@ -238,6 +237,7 @@ class Tempfile < DelegateClass(File)
     # remove tmpname from remover
     @data[0] = @data[1] = nil
     @tmpname = nil
+    ObjectSpace.undefine_finalizer(self)
   end
   alias delete unlink
 
diff --git a/lib/thread.rb b/lib/thread.rb
index 58c4f6b9e6..494a5b33e4 100644
--- a/lib/thread.rb
+++ b/lib/thread.rb
@@ -355,6 +355,22 @@ class SizedQueue < Queue
   def num_waiting
     @waiting.size + @queue_wait.size
   end
+
+  #
+  # Removes all objects from the queue and wakes waiting threads, if any.
+  #
+  def clear
+    @mutex.synchronize do
+      @que.clear
+      begin
+        until @queue_wait.empty?
+          @queue_wait.shift.wakeup
+        end
+      rescue ThreadError
+        retry
+      end
+    end
+  end
 end
 
 # Documentation comments:
diff --git a/lib/time.rb b/lib/time.rb
index 1663af8e76..40b28d9085 100644
--- a/lib/time.rb
+++ b/lib/time.rb
@@ -282,7 +282,11 @@ class Time
       d = Date._strptime(date, format)
       raise ArgumentError, "invalid strptime format - `#{format}'" unless d
       if seconds = d[:seconds]
-        Time.at(seconds)
+        if offset = d[:offset]
+          Time.at(seconds).localtime(offset)
+        else
+          Time.at(seconds)
+        end
       else
         year = d[:year]
         year = yield(year) if year && block_given?
diff --git a/lib/webrick/htmlutils.rb b/lib/webrick/htmlutils.rb
index ed901f1ce2..90994f18b8 100644
--- a/lib/webrick/htmlutils.rb
+++ b/lib/webrick/htmlutils.rb
@@ -15,12 +15,13 @@ module WEBrick
     # Escapes &, ", > and < in +string+
 
     def escape(string)
-      str = string ? string.dup : ""
+      return "" unless string
+      str = string.dup.force_encoding('binary')
       str.gsub!(/&/n, '&amp;')
       str.gsub!(/\"/n, '&quot;')
       str.gsub!(/>/n, '&gt;')
       str.gsub!(/</n, '&lt;')
-      str
+      str.force_encoding(string.encoding)
     end
     module_function :escape
 
diff --git a/lib/webrick/httputils.rb b/lib/webrick/httputils.rb
index f029dacb56..d99573762c 100644
--- a/lib/webrick/httputils.rb
+++ b/lib/webrick/httputils.rb
@@ -350,8 +350,18 @@ module WEBrick
 
     def _make_regex(str) /([#{Regexp.escape(str)}])/n end
     def _make_regex!(str) /([^#{Regexp.escape(str)}])/n end
-    def _escape(str, regex) str.gsub(regex){ "%%%02X" % $1.ord } end
-    def _unescape(str, regex) str.gsub(regex){ $1.hex.chr } end
+    def _escape(str, regex)
+      str = str.dup.force_encoding('binary')
+      str.gsub!(regex) {"%%%02X" % $1.ord}
+      # %-escaped string should contain US-ASCII only
+      str.force_encoding(Encoding::US_ASCII)
+    end
+    def _unescape(str, regex)
+      str = str.dup.force_encoding('binary')
+      str.gsub!(regex) {$1.hex.chr}
+      # encoding of %-unescaped string is unknown
+      str
+    end
 
     UNESCAPED = _make_regex(control+space+delims+unwise+nonascii)
     UNESCAPED_FORM = _make_regex(reserved+control+delims+unwise+nonascii)
diff --git a/lib/yaml.rb b/lib/yaml.rb
index ff9e1a6344..3461f68606 100644
--- a/lib/yaml.rb
+++ b/lib/yaml.rb
@@ -1,18 +1,46 @@
-##
-# The YAML module allows you to use one of the two YAML engines that ship with
-# ruby.  By default Psych is used but the old and unmaintained Syck may be
-# chosen.
+# YAML Ain't Markup Language
 #
-# See Psych or Syck for usage and documentation.
+# This module provides a Ruby interface for data serialization in YAML format.
 #
-# To set the YAML engine to syck:
+# You can choose from one of two YAML engines that ship with Ruby 1.9. By
+# default Psych is used but the old unmaintained Syck may chosen.
 #
-#   YAML::ENGINE.yamler = 'syck'
+# == Usage
+#
+# Working with YAML can be very simple, for example:
+#
+#     require 'yaml' # STEP ONE, REQUIRE YAML!
+#     # Parse a YAML string
+#     YAML.load("--- foo") #=> "foo"
+#
+#     # Emit some YAML
+#     YAML.dump("foo")     # => "--- foo\n...\n"
+#     { :a => 'b'}.to_yaml  # => "---\n:a: b\n"
+#
+# == Security
+#
+# Do not use YAML to load untrusted data. Doing so is unsafe and could allow
+# malicious input to execute arbitrary code inside your application. Please see
+# doc/security.rdoc for more information.
+#
+# == Syck
 #
-# To set the YAML engine back to psych:
+# Syck was the original for YAML implementation in Ruby's standard library
+# developed by why the lucky stiff.
 #
+# If you prefer, you can still use Syck by changing the YAML::ENGINE like so:
+#
+#   YAML::ENGINE.yamler = 'syck'
+#   # switch back to the default Psych
 #   YAML::ENGINE.yamler = 'psych'
-
+#
+# In older Ruby versions, ie. <= 1.9, Syck is still provided, however it was
+# completely removed with the release of Ruby 2.0.0.
+#
+# == More info
+#
+# For more advanced details on the implementation see Psych, and also check out
+# http://yaml.org for spec details and other helpful information.
 module YAML
   class EngineManager # :nodoc:
     attr_reader :yamler
@@ -45,7 +73,7 @@ module YAML
   ##
   # Allows changing the current YAML engine.  See YAML for details.
 
-  ENGINE = YAML::EngineManager.new
+  ENGINE = YAML::EngineManager.new # :nodoc:
 end
 
 if defined?(Psych)
@@ -65,11 +93,11 @@ else
   end
 end
 
-module Syck
+module Syck # :nodoc:
   ENGINE = YAML::ENGINE
 end
 
-module Psych
+module Psych # :nodoc:
   ENGINE = YAML::ENGINE
 end