diff --git a/ChangeLog b/ChangeLog
index 2e60021779..b5a1eeb2d5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Tue Jun 30 23:11:53 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* dir.c (check_dirname): ensure path name NUL-terminated for
+	  SHARABLE_MIDDLE_SUBSTRING.
+
+	* io.c (rb_sysopen): ditto.
+
 Tue Jun 30 18:38:16 2015  NAKAMURA Usaku  <usa@ruby-lang.org>
 
 	* win32/file.c (rb_freopen): need to terminate by NUL.
diff --git a/dir.c b/dir.c
index e271503dce..ee3032d69f 100644
--- a/dir.c
+++ b/dir.c
@@ -1019,6 +1019,7 @@ check_dirname(VALUE dir)
     pend = rb_enc_path_end(rb_enc_path_skip_prefix(path, pend, enc), pend, enc);
     if (pend - path < len) {
 	d = rb_str_subseq(d, 0, pend - path);
+	StringValueCStr(d);
     }
     return rb_str_encode_ospath(d);
 }
diff --git a/io.c b/io.c
index 40d8920081..184f0e6496 100644
--- a/io.c
+++ b/io.c
@@ -5444,6 +5444,7 @@ rb_sysopen(VALUE fname, int oflags, mode_t perm)
     struct sysopen_struct data;
 
     data.fname = rb_str_encode_ospath(fname);
+    StringValueCStr(data.fname);
     data.oflags = oflags;
     data.perm = perm;