* marshal.c (r_bytes0): refined length check. [ruby-dev:32059]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@13704 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,7 @@
+Mon Oct 15 11:45:12 2007  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* marshal.c (r_bytes0): refined length check.  [ruby-dev:32059]
+
 Mon Oct 15 10:24:19 2007  Tanaka Akira  <akr@fsij.org>
 
 	* process.c (pst_to_s): returns a string such as "pid 10220 exit 1"

marshal.c

@@ -929,7 +929,7 @@ r_bytes0(long len, struct load_arg *arg)
 
     if (len == 0) return rb_str_new(0, 0);
     if (TYPE(arg->src) == T_STRING) {
-	if (RSTRING_LEN(arg->src) >= arg->offset + len) {
+	if (RSTRING_LEN(arg->src) - arg->offset >= len) {
 	    str = rb_str_new(RSTRING_PTR(arg->src)+arg->offset, len);
 	    arg->offset += len;
 	}