* marshal.c (r_bytes0): refined length check. [ruby-dev:32059]

git-svn-id: http://svn.ruby-lang.org/repos/ruby/trunk@13704 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 5 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 568165c2f..beee80444 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Mon Oct 15 11:45:12 2007  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* marshal.c (r_bytes0): refined length check.  [ruby-dev:32059]
+
 Mon Oct 15 10:24:19 2007  Tanaka Akira  <akr@fsij.org>
 
 	* process.c (pst_to_s): returns a string such as "pid 10220 exit 1"
diff --git a/marshal.c b/marshal.c
index f442053c5..0590e28ed 100644
--- a/marshal.c
+++ b/marshal.c
@@ -929,7 +929,7 @@ r_bytes0(long len, struct load_arg *arg)
 
     if (len == 0) return rb_str_new(0, 0);
     if (TYPE(arg->src) == T_STRING) {
-	if (RSTRING_LEN(arg->src) >= arg->offset + len) {
+	if (RSTRING_LEN(arg->src) - arg->offset >= len) {
 	    str = rb_str_new(RSTRING_PTR(arg->src)+arg->offset, len);
 	    arg->offset += len;
 	}