diff options
author | mame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-12-22 15:18:12 +0000 |
---|---|---|
committer | mame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-12-22 15:18:12 +0000 |
commit | 1ae2fd82cbd1e2017bed844b74de39f7e9368cc6 (patch) | |
tree | a12e4d262e3a4bacec7f32ab34aa283b58847658 /sprintf.c | |
parent | 129257f0bdf805ebd0a0349a89bccad3d02683ec (diff) | |
download | ruby-1ae2fd82cbd1e2017bed844b74de39f7e9368cc6.tar.gz ruby-1ae2fd82cbd1e2017bed844b74de39f7e9368cc6.tar.xz ruby-1ae2fd82cbd1e2017bed844b74de39f7e9368cc6.zip |
* sprintf.c (rb_str_format): fix buffer overflow.
git-svn-id: http://svn.ruby-lang.org/repos/ruby/trunk@20921 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'sprintf.c')
-rw-r--r-- | sprintf.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -979,8 +979,8 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt) if ((flags & FWIDTH) && need < width) need = width; - CHECK(need); - snprintf(&buf[blen], need, "%*s", need, ""); + CHECK(need + 1); + snprintf(&buf[blen], need + 1, "%*s", need, ""); if (flags & FMINUS) { if (!isnan(fval) && fval < 0.0) buf[blen++] = '-'; |