summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog4
-rw-r--r--sprintf.c4
2 files changed, 6 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index da6066a..c765976 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Tue Dec 23 00:16:48 2008 Yusuke Endoh <mame@tsg.ne.jp>
+
+ * sprintf.c (rb_str_format): fix buffer overflow.
+
Mon Dec 22 19:31:19 2008 Yuki Sonoda (Yugui) <yugui@yugui.jp>
* common.mk (revision.h): uses tool/file2lastrev.rb to support
diff --git a/sprintf.c b/sprintf.c
index 1195f9b..cc8f097 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -979,8 +979,8 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
if ((flags & FWIDTH) && need < width)
need = width;
- CHECK(need);
- snprintf(&buf[blen], need, "%*s", need, "");
+ CHECK(need + 1);
+ snprintf(&buf[blen], need + 1, "%*s", need, "");
if (flags & FMINUS) {
if (!isnan(fval) && fval < 0.0)
buf[blen++] = '-';