* io.c (rb_io_inspect): replace sprintf() with "%s" format all

  over the place by snprintf() to avoid integer overflow.

* sample/svr.rb: service can be stopped by ill-behaved client; use
  tsvr.rb instead.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@8799 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 3 insertions, 2 deletions

diff --git a/struct.c b/struct.c
index 59de2ea618..ed3f9f28ee 100644
--- a/struct.c
+++ b/struct.c
@@ -518,9 +518,10 @@ rb_struct_inspect(s)
 {
     if (rb_inspecting_p(s)) {
 	char *cname = rb_class2name(rb_obj_class(s));
-	VALUE str = rb_str_new(0, strlen(cname) + 15);
+	size_t len = strlen(cname) + 15;
+	VALUE str = rb_str_new(0, len);
 
-	sprintf(RSTRING(str)->ptr, "#<struct %s:...>", cname);
+	snprintf(RSTRING(str)->ptr, len, "#<struct %s:...>", cname);
 	RSTRING(str)->len = strlen(RSTRING(str)->ptr);
 	return str;
     }