diff options
| author | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-15 13:52:58 +0000 |
|---|---|---|
| committer | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-06-15 13:52:58 +0000 |
| commit | 98e63de0d75d18565c629ce9b045edb334e6b477 (patch) | |
| tree | 14396de514a5ee2756aa2296e113a30550b20d97 /string.c | |
| parent | ed4ef1cac4df372adae2dab86d1871b2e3ade86d (diff) | |
merge revision(s) 16400:
* string.c (rb_str_cat): fixed buffer overrun reported by
Christopher Thompson <cthompson at nexopia.com> in [ruby-core:16746]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_5@17296 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'string.c')
| -rw-r--r-- | string.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -744,7 +744,7 @@ rb_str_cat(str, ptr, len) } if (FL_TEST(str, STR_ASSOC)) { rb_str_modify(str); - REALLOC_N(RSTRING(str)->ptr, char, RSTRING(str)->len+len); + REALLOC_N(RSTRING(str)->ptr, char, RSTRING(str)->len+len+1); memcpy(RSTRING(str)->ptr + RSTRING(str)->len, ptr, len); RSTRING(str)->len += len; RSTRING(str)->ptr[RSTRING(str)->len] = '\0'; /* sentinel */ |