* signal.c (trap): remove sigexit(); handle "EXIT" via sig_exec().

  [ruby-dev:26440]

* io.c (rb_io_inspect): replace sprintf() with "%s" format all
  over the place by snprintf() to avoid integer overflow.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@8800 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 8 insertions, 4 deletions

diff --git a/object.c b/object.c
index 8a5eeea6aa..332b22fc61 100644
--- a/object.c
+++ b/object.c
@@ -298,10 +298,12 @@ rb_any_to_s(obj)
     VALUE obj;
 {
     char *cname = rb_obj_classname(obj);
+    size_t len;
     VALUE str;
 
-    str = rb_str_new(0, strlen(cname)+6+16+1); /* 6:tags 16:addr 1:nul */
-    sprintf(RSTRING(str)->ptr, "#<%s:0x%lx>", cname, obj);
+    len = strlen(cname)+6+16+1;
+    str = rb_str_new(0, len); /* 6:tags 16:addr 1:nul */
+    snprintf(RSTRING(str)->ptr, len, "#<%s:0x%lx>", cname, obj);
     RSTRING(str)->len = strlen(RSTRING(str)->ptr);
     if (OBJ_TAINTED(obj)) OBJ_TAINT(str);
 
@@ -383,11 +385,13 @@ rb_obj_inspect(obj)
 	&& ROBJECT(obj)->iv_tbl
 	&& ROBJECT(obj)->iv_tbl->num_entries > 0) {
 	VALUE str;
+	size_t len;
 	char *c;
 
 	c = rb_obj_classname(obj);
-	str = rb_str_new(0, strlen(c)+10+16+1); /* 10:tags 16:addr 1:nul */
-	sprintf(RSTRING(str)->ptr, "-<%s:0x%lx", c, obj);
+	len = strlen(c)+10+16+1;
+	str = rb_str_new(0, len); /* 10:tags 16:addr 1:nul */
+	snprintf(RSTRING(str)->ptr, len, "-<%s:0x%lx", c, obj);
 	RSTRING(str)->len = strlen(RSTRING(str)->ptr);
 	return rb_exec_recursive(inspect_obj, obj, str);
     }