diff options
| author | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-05-13 01:13:55 +0000 |
|---|---|---|
| committer | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-05-13 01:13:55 +0000 |
| commit | 5f0e8f582bb1b84ac67d45f8c4e1637cb184b626 (patch) | |
| tree | 4af0e5c3bc69816c1d2974524e91f195fff2d17c /string.c | |
| parent | 20f4f5f82cf27f297d67621fb42b2562927cb99c (diff) | |
* string.c (rb_str_cat): fixed buffer overrun reported by
Christopher Thompson <cthompson at nexopia.com> in [ruby-core:16746]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@16399 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'string.c')
| -rw-r--r-- | string.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -1448,7 +1448,7 @@ rb_str_cat(VALUE str, const char *ptr, long len) if (STR_ASSOC_P(str)) { rb_str_modify(str); if (STR_EMBED_P(str)) str_make_independent(str); - REALLOC_N(RSTRING(str)->as.heap.ptr, char, RSTRING(str)->as.heap.len+len); + REALLOC_N(RSTRING(str)->as.heap.ptr, char, RSTRING(str)->as.heap.len+len+1); memcpy(RSTRING(str)->as.heap.ptr + RSTRING(str)->as.heap.len, ptr, len); RSTRING(str)->as.heap.len += len; RSTRING(str)->as.heap.ptr[RSTRING(str)->as.heap.len] = '\0'; /* sentinel */ |