* dir.c (range): fix possible "\0" overrun. (in case of "\0-")

git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8@5966 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 9 insertions, 9 deletions

diff --git a/dir.c b/dir.c
index b26eda4c3..efd8f4587 100644
--- a/dir.c
+++ b/dir.c
@@ -107,25 +107,25 @@ range(pat, test, flags)
 
     test = downcase(test);
 
-    while (*pat) {
+    while (*pat != ']') {
 	int cstart, cend;
+        if (escape && *pat == '\\')
+	    pat++;
 	cstart = cend = *pat++;
-	if (cstart == ']')
-	    return ok == not ? 0 : pat;
-        else if (escape && cstart == '\\')
-	    cstart = cend = *pat++;
+	if (!cstart)
+	    return 0;
 	if (*pat == '-' && pat[1] != ']') {
-	    if (escape && pat[1] == '\\')
+	    pat++;
+	    if (escape && *pat == '\\')
 		pat++;
-	    cend = pat[1];
+	    cend = *pat++;
 	    if (!cend)
 		return 0;
-	    pat += 2;
 	}
 	if (downcase(cstart) <= test && test <= downcase(cend))
 	    ok = 1;
     }
-    return 0;
+    return ok == not ? 0 : pat + 1;
 }
 
 #define ISDIRSEP(c) (pathname && isdirsep(c))