merge revision(s) 26903:

	* ext/nkf/nkf-utf8/nkf.c (numchar_getc): get rid of buffer
	  overflow.  [ruby-dev:40606]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_7@28195 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

4 files changed, 12 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 4c7aa248f2..38d708ddae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Mon Jun  7 19:23:04 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* ext/nkf/nkf-utf8/nkf.c (numchar_getc): get rid of buffer
+	  overflow.  [ruby-dev:40606]
+
 Mon Jun  7 18:57:02 2010  NAKAMURA, Hiroshi  <nahi@ruby-lang.org>
 
 	* ext/openssl/ossl_ssl_session.c
diff --git a/ext/nkf/nkf-utf8/nkf.c b/ext/nkf/nkf-utf8/nkf.c
index 9a31c9d879..168cbdbf8b 100644
--- a/ext/nkf/nkf-utf8/nkf.c
+++ b/ext/nkf/nkf-utf8/nkf.c
@@ -5004,7 +5004,7 @@ nkf_char numchar_getc(FILE *f)
     nkf_char (*g)(FILE *) = i_ngetc;
     nkf_char (*u)(nkf_char c ,FILE *f) = i_nungetc;
     int i = 0, j;
-    nkf_char buf[8];
+    nkf_char buf[10];
     long c = -1;
 
     buf[i] = (*g)(f);
diff --git a/test/nkf/test_nkf.rb b/test/nkf/test_nkf.rb
index 279ad59e1a..496bb1da0f 100644
--- a/test/nkf/test_nkf.rb
+++ b/test/nkf/test_nkf.rb
@@ -13,4 +13,9 @@ Ruby"
     assert_equal(::NKF::EUC, NKF.guess(str_euc))
   end
 
+  def test_numchar_input
+    bug2953 = '[ruby-dev:40606]'
+    assert_equal("A", NKF.nkf("-w --numchar-input", "&#x000041;"), bug2953)
+    assert_equal("B", NKF.nkf("-w --numchar-input", "&#0000066;"), bug2953)
+  end
 end
diff --git a/version.h b/version.h
index 0f5a77d750..5f8c415b89 100644
--- a/version.h
+++ b/version.h
@@ -2,7 +2,7 @@
 #define RUBY_RELEASE_DATE "2010-06-07"
 #define RUBY_VERSION_CODE 187
 #define RUBY_RELEASE_CODE 20100607
-#define RUBY_PATCHLEVEL 267
+#define RUBY_PATCHLEVEL 268
 
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 8