diff --git a/ChangeLog b/ChangeLog
index 0dfcd12e24..22317d4a14 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Fri Apr  4 23:24:06 2008  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* re.c (rb_memsearch_qs): wrong boundary condition.
+
+	* re.c (rb_memsearch_qs_utf8): ditto.
+
 Fri Apr  4 14:11:36 2008  Yukihiro Matsumoto  <matz@ruby-lang.org>
 
 	* re.c (rb_memsearch_qs): wrong boundary condition.  a patch from
diff --git a/re.c b/re.c
index 98cead68f2..3f115cd04b 100644
--- a/re.c
+++ b/re.c
@@ -135,7 +135,7 @@ static inline long
 rb_memsearch_qs(const unsigned char *xs, long m, const unsigned char *ys, long n)
 {
     const unsigned char *x = xs, *xe = xs + m;
-    const unsigned char *y = ys, *ye = ys + n;
+    const unsigned char *y = ys;
     VALUE i, qstable[256];
 
     /* Preprocessing */
@@ -144,7 +144,7 @@ rb_memsearch_qs(const unsigned char *xs, long m, const unsigned char *ys, long n
     for (; x < xe; ++x)
 	qstable[*x] = xe - x;
     /* Searching */
-    for (; y + m < ye; y += *(qstable + y[m])) {
+    for (; y + m <= ys + n; y += *(qstable + y[m])) {
 	if (*xs == *y && memcmp(xs, y, m) == 0)
 	    return y - ys;
     }
@@ -187,7 +187,7 @@ static inline long
 rb_memsearch_qs_utf8(const unsigned char *xs, long m, const unsigned char *ys, long n)
 {
     const unsigned char *x = xs, *xe = xs + m;
-    const unsigned char *y = ys, *ye = ys + n;
+    const unsigned char *y = ys;
     VALUE i, qstable[512];
 
     /* Preprocessing */
@@ -198,7 +198,7 @@ rb_memsearch_qs_utf8(const unsigned char *xs, long m, const unsigned char *ys, l
 	qstable[rb_memsearch_qs_utf8_hash(x)] = xe - x;
     }
     /* Searching */
-    for (; y < ye; y += qstable[rb_memsearch_qs_utf8_hash(y+m)]) {
+    for (; y + m <= ys + n; y += qstable[rb_memsearch_qs_utf8_hash(y+m)]) {
 	if (*xs == *y && memcmp(xs, y, m) == 0)
 	    return y - ys;
     }