From 75db84d6ec7c9ef5fd05e5835ac1004df8ea7e2a Mon Sep 17 00:00:00 2001

From: Nobuyoshi Nakada <nobu@ruby-lang.org>
Date: Mon, 16 Aug 2010 18:50:06 +0900
Subject: [PATCH 1/2] 	* util.c (ruby_hdtoa): fixed buffer overrun.  based on a patch
 	  from Peter Weldon at [ruby-core:31725].

---
 util.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/util.c b/util.c
index 97b2d6c..065b2f1 100644
--- a/util.c
+++ b/util.c
@@ -3951,15 +3951,15 @@ ruby_hdtoa(double d, const char *xdigs, int ndigits, int *decpt, int *sign,

 	if (isinf(d)) { /* FP_INFINITE */
 	    *decpt = INT_MAX;
-	    return (nrv_alloc(INFSTR, rve, sizeof(INFSTR) - 1));
+	    return rv_strdup(INFSTR, rve);
 	}
 	else if (isnan(d)) { /* FP_NAN */
 	    *decpt = INT_MAX;
-	    return (nrv_alloc(NANSTR, rve, sizeof(NANSTR) - 1));
+	    return rv_strdup(NANSTR, rve);
 	}
 	else if (d == 0.0) { /* FP_ZERO */
 	    *decpt = 1;
-	    return (nrv_alloc("0", rve, 1));
+	    return rv_strdup("0", rve);
 	}
 	else if (dexp_get(u)) { /* FP_NORMAL */
 	    *decpt = dexp_get(u) - DBL_ADJ;
--
1.7.0.4

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@29010 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,8 @@
+Mon Aug 16 19:22:31 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* util.c (ruby_hdtoa): fixed buffer overrun.  based on a patch
+	  from Peter Weldon at [ruby-core:31725].
+
 Mon Aug 16 17:44:55 2010  Tanaka Akira  <akr@fsij.org>
 
 	* common.mk (capi): use -b option for doxygen.  It disables stdout

util.c

@@ -3951,15 +3951,15 @@ ruby_hdtoa(double d, const char *xdigs, int ndigits, int *decpt, int *sign,
 
 	if (isinf(d)) { /* FP_INFINITE */
 	    *decpt = INT_MAX;
-	    return (nrv_alloc(INFSTR, rve, sizeof(INFSTR) - 1));
+	    return rv_strdup(INFSTR, rve);
 	}
 	else if (isnan(d)) { /* FP_NAN */
 	    *decpt = INT_MAX;
-	    return (nrv_alloc(NANSTR, rve, sizeof(NANSTR) - 1));
+	    return rv_strdup(NANSTR, rve);
 	}
 	else if (d == 0.0) { /* FP_ZERO */
 	    *decpt = 1;
-	    return (nrv_alloc("0", rve, 1));
+	    return rv_strdup("0", rve);
 	}
 	else if (dexp_get(u)) { /* FP_NORMAL */
 	    *decpt = dexp_get(u) - DBL_ADJ;