merge revision(s) 22694,22947:

	* util.c (ruby_dtoa): allocates one more byte to get rid of buffer
	  overrun.  a patch from Charlie Savage at [ruby-core:22604].
	* util.c (rv_strdup): macro to duplicate nul-terminated string.
	  [ruby-core:22852]
	* util.c (ruby_dtoa): allocates one more byte to get rid of buffer
	  overrun.  a patch from Charlie Savage at [ruby-core:22604].


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_7@23630 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 21 insertions, 6 deletions

diff --git a/ChangeLog b/ChangeLog
index dafc15fde6..c9734b391a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+Wed Jun  3 21:09:56 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* util.c (rv_strdup): macro to duplicate nul-terminated string.
+	  [ruby-core:22852]
+
+	* util.c (ruby_dtoa): allocates one more byte to get rid of buffer
+	  overrun.  a patch from Charlie Savage at [ruby-core:22604].
+
+Wed Jun  3 21:09:56 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* util.c (ruby_dtoa): allocates one more byte to get rid of buffer
+	  overrun.  a patch from Charlie Savage at [ruby-core:22604].
+
 Wed Jun  3 21:05:44 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* ext/bigdecimal/bigdecimal.c (gfDebug): uncommented out.
diff --git a/util.c b/util.c
index de18895cb7..2bf6555096 100644
--- a/util.c
+++ b/util.c
@@ -3116,13 +3116,15 @@ nrv_alloc(const char *s, char **rve, int n)
 {
     char *rv, *t;
 
-    t = rv = rv_alloc(n);
+    t = rv = rv_alloc(n+1);
     while ((*t = *s++) != 0) t++;
     if (rve)
         *rve = t;
     return rv;
 }
 
+#define rv_strdup(s, rve) nrv_alloc(s, rve, strlen(s)+1)
+
 /* freedtoa(s) must be used to free values s returned by dtoa
  * when MULTIPLE_THREADS is #defined.  It should be used in all cases,
  * but for consistency with earlier versions of dtoa, it is optional
@@ -3256,9 +3258,9 @@ dtoa(double d, int mode, int ndigits, int *decpt, int *sign, char **rve)
         *decpt = 9999;
 #ifdef IEEE_Arith
         if (!word1(d) && !(word0(d) & 0xfffff))
-            return nrv_alloc("Infinity", rve, 8);
+            return rv_strdup("Infinity", rve);
 #endif
-        return nrv_alloc("NaN", rve, 3);
+        return rv_strdup("NaN", rve);
     }
 #endif
 #ifdef IBM
@@ -3266,7 +3268,7 @@ dtoa(double d, int mode, int ndigits, int *decpt, int *sign, char **rve)
 #endif
     if (!dval(d)) {
         *decpt = 1;
-        return nrv_alloc("0", rve, 1);
+        return rv_strdup("0", rve);
     }
 
 #ifdef SET_INEXACT
@@ -3409,7 +3411,7 @@ dtoa(double d, int mode, int ndigits, int *decpt, int *sign, char **rve)
         if (i <= 0)
             i = 1;
     }
-    s = s0 = rv_alloc(i);
+    s = s0 = rv_alloc(i+1);
 
 #ifdef Honor_FLT_ROUNDS
     if (mode > 1 && rounding != 1)
diff --git a/version.h b/version.h
index 1402d5dc3f..59870c4e55 100644
--- a/version.h
+++ b/version.h
@@ -2,7 +2,7 @@
 #define RUBY_RELEASE_DATE "2009-06-03"
 #define RUBY_VERSION_CODE 187
 #define RUBY_RELEASE_CODE 20090603
-#define RUBY_PATCHLEVEL 169
+#define RUBY_PATCHLEVEL 170
 
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 8