* dir.c (rb_push_glob): fix overrun. [ruby-dev:24886]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@7296 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 13 insertions, 4 deletions

diff --git a/ChangeLog b/ChangeLog
index 77950acc86..58326c5d4c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Wed Nov 17 13:05:10 2004  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* dir.c (rb_push_glob): fix overrun.  [ruby-dev:24886]
+
 Wed Nov 17 09:38:18 2004  Johan Holmberg  <holmberg@iar.se>
 
 	* re.c (rb_reg_initialize_m): should raise exception instead of
@@ -9,7 +13,7 @@ Wed Nov 17 03:42:45 2004  Yukihiro Matsumoto  <matz@ruby-lang.org>
 	  StringValue(), which may alter the receiver.  [ruby-dev:24878]
 
 	* error.c (rb_error_frozen): now raise RuntimeError instead of
-	  TypeError. 
+	  TypeError.
 
 Tue Nov 16 21:22:47 2004  Michael Neumann  <mneumann@ruby-lang.org>
 
@@ -30,7 +34,7 @@ Tue Nov 16 14:31:54 2004  Michael Neumann  <mneumann@ruby-lang.org>
 	  some tests on it (both http and https servers are started).
 
 	* lib/xmlrpc/create.rb (XMLWriter::each_installed_writer),
-	  lib/xmlrpc/parser.rb (XMLParser::each_installed_parser): 
+	  lib/xmlrpc/parser.rb (XMLParser::each_installed_parser):
 	  added methods to simply original test cases
 
 	* lib/xmlrpc/parser.rb, lib/xmlrpc/datetime.rb: applied patch by
diff --git a/dir.c b/dir.c
index 970d13edcb..5e8b89c7f1 100644
--- a/dir.c
+++ b/dir.c
@@ -1500,9 +1500,14 @@ rb_push_glob(str, flags) /* '\0' is delimiter */
 
     while (offset < RSTRING(str)->len) {
 	int status = push_glob(ary, str, offset, flags);
+	char *p, *pend;
 	if (status) rb_jump_tag(status);
-	offset += strlen(RSTRING(str)->ptr+offset) + 1;
-	while (!RSTRING(str)->ptr[offset]) offset++;
+	p = RSTRING(str)->ptr + offset;
+	p += strlen(p) + 1;
+	pend = RSTRING(str)->ptr + RSTRING(str)->len;
+	while (p < pend && !*p)
+	    p++;
+	offset = p - RSTRING(str)->ptr;
     }
 
     if (rb_block_given_p()) {