Backport #1232. Fixed sprintf buffer corruption.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_6@24583 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
ruby · Aug 19, 2009 · 9c3ecf6 · 9c3ecf6
1 parent b4f5ab9
commit 9c3ecf6
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,7 @@
+Wed Aug 19 1:49:00 2009 Kirk Haines <khaines@ruby-lang.org>
+
+	* Backport #1232; Writes one extra byte to the buffer in order to prevent overrun.
+
 Tue Aug 4   8:53:00 2009 Kirk Haines <khaines@ruby-lang.org>
 
 	* lib/rdoc/parsers/parse_c.rb: Fixed a small error in the documentation.

diff --git a/util.c b/util.c
@@ -3403,7 +3403,7 @@ dtoa(double d, int mode, int ndigits, int *decpt, int *sign, char **rve)
         if (i <= 0)
             i = 1;
     }
-    s = s0 = rv_alloc(i);
+    s = s0 = rv_alloc(i+1);
 
 #ifdef Honor_FLT_ROUNDS
     if (mode > 1 && rounding != 1)