diff --git a/ChangeLog b/ChangeLog
index 86c65a835c..dea37ff634 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Wed Oct 20 10:47:21 2010  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* util.c (ruby_strtod): reject 0x1.p+0. [ruby-dev:42432] #3966
+
 Wed Oct 20 10:00:57 2010  NARUSE, Yui  <naruse@ruby-lang.org>
 
 	* vsnprintf.c (BSD_vfprintf): print floating point on "%#a".
diff --git a/test/ruby/test_float.rb b/test/ruby/test_float.rb
index 961596b9a3..dd61f1919b 100644
--- a/test/ruby/test_float.rb
+++ b/test/ruby/test_float.rb
@@ -88,13 +88,15 @@ class TestFloat < Test::Unit::TestCase
     assert_raise(ArgumentError){Float("-.")}
     assert_raise(ArgumentError){Float("1e")}
     assert_raise(ArgumentError){Float("1__1")}
+    assert_raise(ArgumentError){Float("1.")}
+    assert_raise(ArgumentError){Float("1.e+00")}
+    assert_raise(ArgumentError){Float("0x1.p+0")}
     # add expected behaviour here.
     assert_equal(10, Float("1_0"))
 
     assert_equal([ 0.0].pack('G'), [Float(" 0x0p+0").to_f].pack('G'))
     assert_equal([-0.0].pack('G'), [Float("-0x0p+0").to_f].pack('G'))
     assert_equal(255.0,     Float("0Xff"))
-    assert_equal(1.0,       Float("0X1.P+0"))
     assert_equal(1024.0,    Float("0x1p10"))
     assert_equal(1024.0,    Float("0x1p+10"))
     assert_equal(0.0009765625, Float("0x1p-10"))
@@ -452,7 +454,7 @@ class TestFloat < Test::Unit::TestCase
     assert_raise(ArgumentError) { Float('0xfp') }
     assert_raise(ArgumentError) { Float('0xf.') }
     assert_raise(ArgumentError) { Float('0xf.p') }
-    assert_equal(15, Float('0xf.p0'))
+    assert_raise(ArgumentError) { Float('0xf.p0') }
     assert_raise(ArgumentError) { Float('0xf.f') }
     assert_raise(ArgumentError) { Float('0xf.fp') }
     assert_equal(Float::INFINITY, Float('0xf.fp1000000000000000'))
diff --git a/util.c b/util.c
index 6cd2d2049e..53a4e9f89e 100644
--- a/util.c
+++ b/util.c
@@ -2132,10 +2132,11 @@ break2:
 
 	    if (*s == '.') {
 		aadj = 1.;
-		while (*++s && (s1 = strchr(hexdigit, *s))) {
+		if (!*++s || !(s1 = strchr(hexdigit, *s))) goto ret0;
+		do {
 		    aadj /= 16;
 		    adj += aadj * ((s1 - hexdigit) & 15);
-		}
+		} while (*++s && (s1 = strchr(hexdigit, *s)));
 	    }
 
 	    if (*s == 'P' || *s == 'p') {