diff --git a/ChangeLog b/ChangeLog
index 10f60bd896..3a609f60cc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sun Mar  1 19:36:18 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* util.c (ruby_dtoa): allocates one more byte to get rid of buffer
+	  overrun.  a patch from Charlie Savage at [ruby-core:22604].
+
 Sun Mar  1 19:10:59 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* common.mk (.y.c): removed extra backslash.  [ruby-core:22602]
diff --git a/util.c b/util.c
index 05a442ba76..50ddb2b315 100644
--- a/util.c
+++ b/util.c
@@ -3362,7 +3362,7 @@ ruby_dtoa(double d_, int mode, int ndigits, int *decpt, int *sign, char **rve)
         if (i <= 0)
             i = 1;
     }
-    s = s0 = rv_alloc(i);
+    s = s0 = rv_alloc(i+1);
 
 #ifdef Honor_FLT_ROUNDS
     if (mode > 1 && rounding != 1)