* io.c (rb_io_inspect): replace sprintf() with "%s" format all

  over the place by snprintf() to avoid integer overflow.

* sample/svr.rb: service can be stopped by ill-behaved client; use
  tsvr.rb instead.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@8799 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 3 insertions, 2 deletions

diff --git a/dln.c b/dln.c
index fbfd6c2db2..0993a84161 100644
--- a/dln.c
+++ b/dln.c
@@ -962,8 +962,9 @@ load_lib(lib)
     dln_errno = DLN_EBADLIB;
 
     if (lib[0] == '-' && lib[1] == 'l') {
-	char *p = alloca(strlen(lib) + 4);
-	sprintf(p, "lib%s.a", lib+2);
+	long len = strlen(lib) + 4;
+	char *p = alloca(len);
+	snprintf(p, len, "lib%s.a", lib+2);
 	lib = p;
     }