wyhaines	2009-08-19 22:53:23 +0900 (Wed, 19 Aug 2009)

  New Revision: 24583

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=24583

  Log:
    Backport #1232. Fixed sprintf buffer corruption.

  Modified files:
    branches/ruby_1_8_6/ChangeLog
    branches/ruby_1_8_6/util.c

Index: ruby_1_8_6/util.c
===================================================================
--- ruby_1_8_6/util.c	(revision 24582)
+++ ruby_1_8_6/util.c	(revision 24583)
@@ -3403,7 +3403,7 @@
         if (i <= 0)
             i = 1;
     }
-    s = s0 = rv_alloc(i);
+    s = s0 = rv_alloc(i+1);
 
 #ifdef Honor_FLT_ROUNDS
     if (mode > 1 && rounding != 1)
Index: ruby_1_8_6/ChangeLog
===================================================================
--- ruby_1_8_6/ChangeLog	(revision 24582)
+++ ruby_1_8_6/ChangeLog	(revision 24583)
@@ -1,3 +1,7 @@
+Wed Aug 19 1:49:00 2009 Kirk Haines <khaines@r...>
+
+	* Backport #1232; Writes one extra byte to the buffer in order to prevent overrun.
+
 Tue Aug 4   8:53:00 2009 Kirk Haines <khaines@r...>
 
 	* lib/rdoc/parsers/parse_c.rb: Fixed a small error in the documentation.

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/