mame	2008-12-23 00:18:12 +0900 (Tue, 23 Dec 2008)

  New Revision: 20921

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=20921

  Log:
    * sprintf.c (rb_str_format): fix buffer overflow.

  Modified files:
    trunk/ChangeLog
    trunk/sprintf.c

Index: ChangeLog
===================================================================
--- ChangeLog	(revision 20920)
+++ ChangeLog	(revision 20921)
@@ -1,3 +1,7 @@
+Tue Dec 23 00:16:48 2008  Yusuke Endoh  <mame@t...>
+
+	* sprintf.c (rb_str_format): fix buffer overflow.
+
 Mon Dec 22 19:31:19 2008  Yuki Sonoda (Yugui)  <yugui@y...>
 
 	* common.mk (revision.h): uses tool/file2lastrev.rb to support
Index: sprintf.c
===================================================================
--- sprintf.c	(revision 20920)
+++ sprintf.c	(revision 20921)
@@ -979,8 +979,8 @@
 		    if ((flags & FWIDTH) && need < width)
 			need = width;
 
-		    CHECK(need);
-		    snprintf(&buf[blen], need, "%*s", need, "");
+		    CHECK(need + 1);
+		    snprintf(&buf[blen], need + 1, "%*s", need, "");
 		    if (flags & FMINUS) {
 			if (!isnan(fval) && fval < 0.0)
 			    buf[blen++] = '-';

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/