From 2fcd15d45d983469a2a67bbdb78da2ff1fc7bce4 Mon Sep 17 00:00:00 2001
From: mame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Thu, 28 Aug 2008 15:03:38 +0000
Subject: [PATCH] * file.c (file_expand_path): check invalid access.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@18905 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog | 4 ++++
 file.c    | 1 +
 2 files changed, 5 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index abd6d35693..b2885331cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Fri Aug 29 00:03:13 2008  Yusuke Endoh  <mame@tsg.ne.jp>
+
+	* file.c (file_expand_path): check invalid access.
+
 Thu Aug 28 23:55:50 2008  Shugo Maeda  <shugo@ruby-lang.org>
 
 	* strftime.c (rb_strftime): Time.mktime(2000).strftime("%-S") should
diff --git a/file.c b/file.c
index fbbea23282..0cd90afb8b 100644
--- a/file.c
+++ b/file.c
@@ -2734,6 +2734,7 @@ file_expand_path(VALUE fname, VALUE dname, int abs_mode, VALUE result)
 	*p = '/';
     }
 
+    BUFCHECK(bdiff + 1 >= buflen);
     p[1] = 0;
     root = skipprefix(buf);