* dir.c (rb_push_glob): fix overrun. [ruby-dev:24886]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@7296 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 7 insertions, 2 deletions

diff --git a/dir.c b/dir.c
index 970d13edcb..5e8b89c7f1 100644
--- a/dir.c
+++ b/dir.c
@@ -1500,9 +1500,14 @@ rb_push_glob(str, flags) /* '\0' is delimiter */
 
     while (offset < RSTRING(str)->len) {
 	int status = push_glob(ary, str, offset, flags);
+	char *p, *pend;
 	if (status) rb_jump_tag(status);
-	offset += strlen(RSTRING(str)->ptr+offset) + 1;
-	while (!RSTRING(str)->ptr[offset]) offset++;
+	p = RSTRING(str)->ptr + offset;
+	p += strlen(p) + 1;
+	pend = RSTRING(str)->ptr + RSTRING(str)->len;
+	while (p < pend && !*p)
+	    p++;
+	offset = p - RSTRING(str)->ptr;
     }
 
     if (rb_block_given_p()) {