* io.c (rb_io_inspect): replace sprintf() with "%s" format all

  over the place by snprintf() to avoid integer overflow.

* sample/svr.rb: service can be stopped by ill-behaved client; use
  tsvr.rb instead.


git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8@8799 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 4 insertions, 3 deletions

diff --git a/hash.c b/hash.c
index 632f0dcaa..09d866b13 100644
--- a/hash.c
+++ b/hash.c
@@ -1820,7 +1820,7 @@ ruby_setenv(name, value)
     else
 	unsetenv(name);
 #else  /* WIN32 */
-
+    size_t len;
     int i=envix(name);		        /* where does it go? */
 
     if (environ == origenviron) {	/* need we copy environment? */
@@ -1853,9 +1853,10 @@ ruby_setenv(name, value)
 	REALLOC_N(environ, char*, i+2);	/* just expand it a bit */
 	environ[i+1] = 0;	/* make sure it's null terminated */
     }
-    environ[i] = ALLOC_N(char, strlen(name) + strlen(value) + 2);
+    len = strlen(name) + strlen(value) + 2;
+    environ[i] = ALLOC_N(char, len);
 #ifndef MSDOS
-    sprintf(environ[i],"%s=%s",name,value); /* all that work just for this */
+    snprintf(environ[i],len,"%s=%s",name,value); /* all that work just for this */
 #else
     /* MS-DOS requires environment variable names to be in uppercase */
     /* [Tom Dinger, 27 August 1990: Well, it doesn't _require_ it, but