From 60243650cff2fbf678806bed4b0d57c6209d10cc Mon Sep 17 00:00:00 2001
From: shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Thu, 19 Jun 2008 23:12:46 +0000
Subject: * array.c (ary_new, rb_ary_initialize, rb_ary_store,   rb_ary_aplice,
 rb_ary_times): integer overflows should be   checked. based on patches from
 Drew Yao <ayao at apple.com>   fixed CVE-2008-2726

* string.c (rb_str_buf_append): fixed unsafe use of alloca,
  which led memory corruption. based on a patch from Drew Yao
  <ayao at apple.com> fixed CVE-2008-2726

* sprintf.c (rb_str_format): backported from trunk.

* intern.h: ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_5@17460 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'ChangeLog')

diff --git a/ChangeLog b/ChangeLog
index 4718c49370..e5ae26fc89 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,18 @@
+Wed Jun 18 22:25:28 2008  URABE Shyouhei  <shyouhei@ruby-lang.org>
+
+	* array.c (ary_new, rb_ary_initialize, rb_ary_store,
+	  rb_ary_aplice, rb_ary_times): integer overflows should be
+	  checked. based on patches from Drew Yao <ayao at apple.com>
+	  fixed CVE-2008-2726
+
+	* string.c (rb_str_buf_append): fixed unsafe use of alloca,
+	  which led memory corruption. based on a patch from Drew Yao
+	  <ayao at apple.com> fixed CVE-2008-2726
+
+	* sprintf.c (rb_str_format): backported from trunk.
+
+	* intern.h: ditto.
+
 Fri Jun 20 01:40:21 2008  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* array.c (rb_ary_equal, rb_ary_eql, rb_ary_hash, rb_ary_cmp):
-- 
cgit v1.2.3