diff --git a/ChangeLog b/ChangeLog
index 8e0537d344..04dfe6e135 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Tue Sep 25 15:11:32 2007  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* io.c (io_ungetc): reallocate internal buffer if pushing data
+	  excess capacity.  [ruby-dev:31650]
+
 Tue Sep 25 13:43:03 2007  Yukihiro Matsumoto  <matz@ruby-lang.org>
 
 	* eval_method.ci (remove_method): should not remove undef place
diff --git a/bootstraptest/test_knownbug.rb b/bootstraptest/test_knownbug.rb
index 03feb653a3..07ba5e8e2c 100644
--- a/bootstraptest/test_knownbug.rb
+++ b/bootstraptest/test_knownbug.rb
@@ -6,11 +6,15 @@
 assert_equal 'ok', %q{
 begin
   r, w = IO.pipe
+  w.write "foo"
   w.close
   # assert_raise(IOError, "[ruby-dev:31650]") { 20000.times { r.ungetc "a" } }
+  r.getc
   20000.times { r.ungetc "a" }
-rescue IOError
-  :ok
+  data = r.read
+  if data.size == 20002 && data[-5..-1] == "aaaoo"
+    :ok
+  end
 ensure
   r.close
 end
diff --git a/io.c b/io.c
index 944a4f3749..134b35c0ba 100644
--- a/io.c
+++ b/io.c
@@ -296,20 +296,17 @@ io_ungetc(VALUE str, rb_io_t *fptr)
 	    fptr->rbuf_capa = 8192;
         fptr->rbuf = ALLOC_N(char, fptr->rbuf_capa);
     }
-    if (fptr->rbuf_off == 0) {
-        if (fptr->rbuf_len) {
-            MEMMOVE(fptr->rbuf+len, fptr->rbuf, char, fptr->rbuf_len);
-	}
-        fptr->rbuf_off = len;
-    }
-    else if (fptr->rbuf_off < len) {
+    if (fptr->rbuf_off < len) {
 	int capa = fptr->rbuf_len + len;
 	char *buf = ALLOC_N(char, capa);
 
         if (fptr->rbuf_len) {
             MEMMOVE(buf+len, fptr->rbuf+fptr->rbuf_off, char, fptr->rbuf_len);
 	}
+	fptr->rbuf_capa = capa;
 	fptr->rbuf_off = len;
+	free(fptr->rbuf);
+        fptr->rbuf = buf;
     }
     fptr->rbuf_off-=len;
     fptr->rbuf_len+=len;