merge revision(s) 46416: [Backport #9942]

	* array.c (rb_ary_permutation): `p` is the array of size `r`, as
	  commented at permute0().  since `n >= r` here, buffer overflow
	  never happened, just reduce unnecessary allocation though.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47331 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 11 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index 5d9b9ff872..f6aa2e078e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Sun Aug 31 15:23:25 2014  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* array.c (rb_ary_permutation): `p` is the array of size `r`, as
+	  commented at permute0().  since `n >= r` here, buffer overflow
+	  never happened, just reduce unnecessary allocation though.
+
 Mon Jul  7 13:05:04 2014  SHIBATA Hiroshi  <shibata.hiroshi@gmail.com>
 
 	* test/test_timeout.rb (test_timeout): inverted test condition.
diff --git a/array.c b/array.c
index edf40c9ee1..5e95e87685 100644
--- a/array.c
+++ b/array.c
@@ -4660,7 +4660,7 @@ rb_ary_permutation(int argc, VALUE *argv, VALUE ary)
 	}
     }
     else {             /* this is the general case */
-	volatile VALUE t0 = tmpbuf(n,sizeof(long));
+	volatile VALUE t0 = tmpbuf(r,sizeof(long));
 	long *p = (long*)RSTRING_PTR(t0);
 	volatile VALUE t1 = tmpbuf(n,sizeof(char));
 	char *used = (char*)RSTRING_PTR(t1);
diff --git a/version.h b/version.h
index bac60b20d1..b47efb5314 100644
--- a/version.h
+++ b/version.h
@@ -1,10 +1,10 @@
 #define RUBY_VERSION "2.0.0"
-#define RUBY_RELEASE_DATE "2014-07-07"
-#define RUBY_PATCHLEVEL 531
+#define RUBY_RELEASE_DATE "2014-08-31"
+#define RUBY_PATCHLEVEL 532
 
 #define RUBY_RELEASE_YEAR 2014
-#define RUBY_RELEASE_MONTH 7
-#define RUBY_RELEASE_DAY 7
+#define RUBY_RELEASE_MONTH 8
+#define RUBY_RELEASE_DAY 31
 
 #include "ruby/version.h"