diff --git a/ChangeLog b/ChangeLog index afcd6ac09d..101fb3bcd9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +Thu Mar 3 14:25:19 2011 NARUSE, Yui + + * strftime.c (STRFTIME): return 0 and ERANGE when precision is too + large. [ruby-dev:43284] fixes #4456 + Thu Mar 3 00:46:51 2011 NARUSE, Yui * addr2line.c (uleb128): cast the value to unsigned long. diff --git a/strftime.c b/strftime.c index dc6df615d7..9d9f48d0de 100644 --- a/strftime.c +++ b/strftime.c @@ -237,6 +237,10 @@ rb_strftime_with_timespec(char *s, size_t maxsize, const char *format, const str i = rb_strftime_with_timespec(s, endp - s, (fmt), vtm, timev, ts, gmt); \ if (!i) return 0; \ if (precision > i) {\ + if (start + maxsize < s + precision) { \ + errno = ERANGE; \ + return 0; \ + } \ memmove(s + precision - i, s, i);\ memset(s, padding ? padding : ' ', precision - i); \ s += precision; \