diff --git a/ChangeLog b/ChangeLog
index c16d1f974c..67e3184dfa 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Sun Jun 15 23:24:32 2008  NAKAMURA Usaku  <usa@ruby-lang.org>
+
+	* file.c (BUFCHECK): wrong condition. [ruby-core:16921]
+
+	* file.c (file_expand_buf): shouldn't use buflen for length of string.
+
 Sun Jun 15 23:21:22 2008  Akinori MUSHA  <knu@iDaemons.org>
 
 	* marshal.c (r_object0, Init_marshal): Fix the garbled s_call
diff --git a/file.c b/file.c
index 3a6295d3c8..11ae04f350 100644
--- a/file.c
+++ b/file.c
@@ -2509,8 +2509,12 @@ ntfs_tail(const char *path)
 
 #define BUFCHECK(cond) do {\
     long bdiff = p - buf;\
-    while (cond) {\
-	buflen *= 2;\
+    if (cond) {\
+	do {buflen *= 2;} while (cond);\
+	rb_str_resize(result, buflen);\
+	buf = RSTRING(result)->ptr;\
+	p = buf + bdiff;\
+	pend = buf + buflen;\
     }\
     rb_str_resize(result, buflen);\
     buf = RSTRING(result)->ptr;\
@@ -2751,7 +2755,6 @@ file_expand_path(fname, dname, result)
 	p += s-b;
     }
     if (p == skiproot(buf) - 1) p++;
-    buflen = p - buf;
 
 #if USE_NTFS
     *p = '\0';
@@ -2800,13 +2803,14 @@ file_expand_path(fname, dname, result)
 	    buflen = ++p - buf + len;
 	    rb_str_resize(result, buflen);
 	    memcpy(p, wfd.cFileName, len + 1);
+	    p += len;
 	}
     }
 #endif
 
     if (tainted) OBJ_TAINT(result);
-    RSTRING(result)->len = buflen;
-    RSTRING(result)->ptr[buflen] = '\0';
+    RSTRING(result)->len = p - buf;
+    RSTRING(result)->ptr[p - buf] = '\0';
     return result;
 }
 
diff --git a/version.h b/version.h
index 7933e15fdc..f7e5bcb3c6 100644
--- a/version.h
+++ b/version.h
@@ -2,7 +2,7 @@
 #define RUBY_RELEASE_DATE "2008-06-15"
 #define RUBY_VERSION_CODE 186
 #define RUBY_RELEASE_CODE 20080615
-#define RUBY_PATCHLEVEL 217
+#define RUBY_PATCHLEVEL 218
 
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 8