4 files changed, 23 insertions, 4 deletions
diff --git a/ChangeLog b/ChangeLog
index 1e50949eed..df20a42e1d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Wed Dec 16 16:13:04 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* io.c (parse_mode_enc): fix buffer overflow.
+
 Wed Dec 16 16:10:52 2015  Eric Wong  <e@80x24.org>
 
 	* insns.def (opt_case_dispatch): avoid converting Infinity
diff --git a/io.c b/io.c
index bf859578cc..086fc358e3 100644
--- a/io.c
+++ b/io.c
@@ -5059,9 +5059,11 @@ parse_mode_enc(const char *estr, rb_encoding **enc_p, rb_encoding **enc2_p, int
 	    fmode |= FMODE_SETENC_BY_BOM;
 	    estr += 4;
             len -= 4;
-	    memcpy(encname, estr, len);
-	    encname[len] = '\0';
-	    estr = encname;
+	    if (len > 0 && len <= ENCODING_MAXNAMELEN) {
+		memcpy(encname, estr, len);
+		encname[len] = '\0';
+		estr = encname;
+	    }
 	}
 	idx = rb_enc_find_index(estr);
     }
diff --git a/test/ruby/test_io_m17n.rb b/test/ruby/test_io_m17n.rb
index 5fbf056cd9..95081322d4 100644
--- a/test/ruby/test_io_m17n.rb
+++ b/test/ruby/test_io_m17n.rb
@@ -2073,6 +2073,19 @@ EOT
     }
   end
 
+  def test_bom_too_long_utfname
+    assert_separately([], <<-'end;') # do
+      assert_warn(/Unsupported encoding/) {
+        open(IO::NULL, "r:bom|utf-" + "x" * 10000) {}
+      }
+    end;
+    assert_separately([], <<-'end;') # do
+      assert_warn(/Unsupported encoding/) {
+        open(IO::NULL, encoding: "bom|utf-" + "x" * 10000) {}
+      }
+    end;
+  end
+
   def test_cbuf
     with_tmpdir {
       fn = "tst"
diff --git a/version.h b/version.h
index f1d360d8e2..f25921ec9f 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.1.8"
 #define RUBY_RELEASE_DATE "2015-12-16"
-#define RUBY_PATCHLEVEL 437
+#define RUBY_PATCHLEVEL 438
 
 #define RUBY_RELEASE_YEAR 2015
 #define RUBY_RELEASE_MONTH 12