2 files changed, 6 insertions, 10 deletions
diff --git a/ChangeLog b/ChangeLog
index ff81be4fac..b8f0048ef5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sat Dec 22 01:52:11 2007  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* io.c (io_ungetc): avoid buffer relocation, which might cause
+	  serious problem under concurrent situation.
+
 Sat Dec 22 01:35:41 2007  Tanaka Akira  <akr@fsij.org>
 
 	* re.c (ARG_ENCODING_NONE): defined for /.../n option.
diff --git a/io.c b/io.c
index 659784a777..06a0c3aa23 100644
--- a/io.c
+++ b/io.c
@@ -310,16 +310,7 @@ io_ungetc(VALUE str, rb_io_t *fptr)
         fptr->rbuf = ALLOC_N(char, fptr->rbuf_capa);
     }
     if (fptr->rbuf_off < len) {
-	int capa = fptr->rbuf_len + len;
-	char *buf = ALLOC_N(char, capa);
-
-        if (fptr->rbuf_len) {
-            MEMMOVE(buf+len, fptr->rbuf+fptr->rbuf_off, char, fptr->rbuf_len);
-	}
-	fptr->rbuf_capa = capa;
-	fptr->rbuf_off = len;
-	free(fptr->rbuf);
-        fptr->rbuf = buf;
+	rb_raise(rb_eIOError, "ungetc failed");
     }
     fptr->rbuf_off-=len;
     fptr->rbuf_len+=len;