diff --git a/ChangeLog b/ChangeLog
index 2897810ba..da05afaf2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Wed Dec 16 20:17:40 2009  NAKAMURA Usaku  <usa@ruby-lang.org>
+
+	* win32/win32.c (CreateChild): allocate temporary buffer and use it
+	  instead of directly modify the passed string.  [ruby-dev:39635]
+
 Wed Dec 16 19:49:47 2009  URABE Shyouhei  <shyouhei@ruby-lang.org>
 
 	* instruby.rb (with_destdir): revert. [ruby-dev:39885]
diff --git a/version.h b/version.h
index e249f36d7..b88e1d57b 100644
--- a/version.h
+++ b/version.h
@@ -2,7 +2,7 @@
 #define RUBY_RELEASE_DATE "2009-12-16"
 #define RUBY_VERSION_CODE 187
 #define RUBY_RELEASE_CODE 20091216
-#define RUBY_PATCHLEVEL 241
+#define RUBY_PATCHLEVEL 242
 
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 8
diff --git a/win32/win32.c b/win32/win32.c
index c9081327f..c4b6a124a 100644
--- a/win32/win32.c
+++ b/win32/win32.c
@@ -1066,11 +1066,13 @@ CreateChild(const char *cmd, const char *prog, SECURITY_ATTRIBUTES *psa,
 	}
     }
     if (p) {
-	shell = p;
-	while (*p) {
-	    if ((unsigned char)*p == '/')
-		*p = '\\';
-	    p = CharNext(p);
+	char *tmp = ALLOCA_N(char, strlen(p) + 1);
+	strcpy(tmp, p);
+	shell = tmp;
+	while (*tmp) {
+	    if ((unsigned char)*tmp == '/')
+		*tmp = '\\';
+	    tmp = CharNext(tmp);
 	}
     }