merges r22692 from trunk into ruby_1_9_1.

--
* util.c (ruby_dtoa): allocates one more byte to get rid of buffer
  overrun.  a patch from Charlie Savage at [ruby-core:22604].

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_1@22756 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 6 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 34d70a8a9b..6f0dc0e3ed 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sun Mar  1 19:36:18 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* util.c (ruby_dtoa): allocates one more byte to get rid of buffer
+	  overrun.  a patch from Charlie Savage at [ruby-core:22604].
+
 Sun Mar  1 19:10:59 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* common.mk (.y.c): removed extra backslash.  [ruby-core:22602]
diff --git a/util.c b/util.c
index 8e166eb2fb..0e065ff0b2 100644
--- a/util.c
+++ b/util.c
@@ -3370,7 +3370,7 @@ ruby_dtoa(double d_, int mode, int ndigits, int *decpt, int *sign, char **rve)
         if (i <= 0)
             i = 1;
     }
-    s = s0 = rv_alloc(i);
+    s = s0 = rv_alloc(i+1);
 
 #ifdef Honor_FLT_ROUNDS
     if (mode > 1 && rounding != 1)