* file.c (file_expand_path): check invalid access.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@18905 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 1 insertions, 0 deletions

diff --git a/file.c b/file.c
index fbbea23282..0cd90afb8b 100644
--- a/file.c
+++ b/file.c
@@ -2734,6 +2734,7 @@ file_expand_path(VALUE fname, VALUE dname, int abs_mode, VALUE result)
 	*p = '/';
     }
 
+    BUFCHECK(bdiff + 1 >= buflen);
     p[1] = 0;
     root = skipprefix(buf);