diff options
-rw-r--r-- | ChangeLog | 4 | ||||
-rw-r--r-- | sprintf.c | 4 |
2 files changed, 6 insertions, 2 deletions
@@ -1,3 +1,7 @@ +Tue Dec 23 00:16:48 2008 Yusuke Endoh <mame@tsg.ne.jp> + + * sprintf.c (rb_str_format): fix buffer overflow. + Mon Dec 22 19:31:19 2008 Yuki Sonoda (Yugui) <yugui@yugui.jp> * common.mk (revision.h): uses tool/file2lastrev.rb to support @@ -979,8 +979,8 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt) if ((flags & FWIDTH) && need < width) need = width; - CHECK(need); - snprintf(&buf[blen], need, "%*s", need, ""); + CHECK(need + 1); + snprintf(&buf[blen], need + 1, "%*s", need, ""); if (flags & FMINUS) { if (!isnan(fval) && fval < 0.0) buf[blen++] = '-'; |