diff options
| author | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-05-13 01:13:55 +0000 |
|---|---|---|
| committer | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-05-13 01:13:55 +0000 |
| commit | cf16bcbad04ebdefe10de6f15e9dfc610d521807 (patch) | |
| tree | 4af0e5c3bc69816c1d2974524e91f195fff2d17c /string.c | |
| parent | b1d55ef8afb94ef1d5c3adb809cbf1681f159afa (diff) | |
| download | ruby-cf16bcbad04ebdefe10de6f15e9dfc610d521807.tar.gz ruby-cf16bcbad04ebdefe10de6f15e9dfc610d521807.tar.xz ruby-cf16bcbad04ebdefe10de6f15e9dfc610d521807.zip | |
* string.c (rb_str_cat): fixed buffer overrun reported by
Christopher Thompson <cthompson at nexopia.com> in [ruby-core:16746]
git-svn-id: http://svn.ruby-lang.org/repos/ruby/trunk@16399 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'string.c')
| -rw-r--r-- | string.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -1448,7 +1448,7 @@ rb_str_cat(VALUE str, const char *ptr, long len) if (STR_ASSOC_P(str)) { rb_str_modify(str); if (STR_EMBED_P(str)) str_make_independent(str); - REALLOC_N(RSTRING(str)->as.heap.ptr, char, RSTRING(str)->as.heap.len+len); + REALLOC_N(RSTRING(str)->as.heap.ptr, char, RSTRING(str)->as.heap.len+len+1); memcpy(RSTRING(str)->as.heap.ptr + RSTRING(str)->as.heap.len, ptr, len); RSTRING(str)->as.heap.len += len; RSTRING(str)->as.heap.ptr[RSTRING(str)->as.heap.len] = '\0'; /* sentinel */ |